Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://pdf-ezy.com/pdf-ez.exe

Overview

General Information

Sample URL:https://pdf-ezy.com/pdf-ez.exe
Analysis ID:1581050
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Potentially malicious time measurement code found
Contains functionality for execution timing, often used to detect debuggers
Detected potential crypto function
Drops PE files
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64native
  • cmd.exe (PID: 3236 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 4700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • wget.exe (PID: 4268 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • pdf-ez.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\download\pdf-ez.exe" MD5: ADDD963C82C2AA246A853EE7CC114B00)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3716, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1, ProcessId: 3236, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Desktop\download\pdf-ez.exeReversingLabs: Detection: 15%

Bitcoin Miner

barindex
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD046E0 4_2_00007FF60AD046E0
Source: unknownHTTPS traffic detected: 172.67.152.3:443 -> 192.168.11.20:49758 version: TLS 1.2
Source: Binary string: WebView2Loader.dll.pdb source: pdf-ez.exe, 00000004.00000000.201075089443.00007FF60AEF7000.00000008.00000001.01000000.00000003.sdmp, pdf-ez.exe, 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmp, pdf-ez.exe.2.dr
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4x nop then shr r10, 0Dh4_2_00007FF60ACFCB00
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4x nop then lock or byte ptr [rdx], dil4_2_00007FF60ACF2020
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4x nop then shr r10, 0Dh4_2_00007FF60ACFDF80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4x nop then cmp rdx, 40h4_2_00007FF60ACF18E0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4x nop then cmp rdx, rbx4_2_00007FF60ACDC860
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /pdf-ez.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: pdf-ezy.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: pdf-ezy.com
Source: pdf-ez.exe.2.drString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crlN
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: pdf-ez.exe.2.drString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://ocsp.sectigo.com0
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://ocsps.ssl.com0
Source: pdf-ez.exe.2.drString found in binary or memory: http://ocsps.ssl.com0_
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: wget.exe, 00000002.00000002.201063601665.0000000001530000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: https://pdf-ezy.com/pdf-ez.exe
Source: wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pdf-ezy.com/pdf-ez.exeL
Source: wget.exe, 00000002.00000002.201063601665.0000000001530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pdf-ezy.com/pdf-ez.exeM
Source: wget.exe, 00000002.00000002.201063601665.0000000001530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pdf-ezy.com/pdf-ez.exeur
Source: wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drString found in binary or memory: https://sectigo.com/CPS0
Source: pdf-ez.exeString found in binary or memory: https://static.pdf-ezy.comUTF16From
Source: pdf-ez.exe, pdf-ez.exe, 00000004.00000000.201074719258.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmp, pdf-ez.exe, 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmp, pdf-ez.exe.2.drString found in binary or memory: https://static.pdf-ezy.comUTF16FromString
Source: pdf-ez.exe.2.drString found in binary or memory: https://www.ssl.com/repository0
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownHTTPS traffic detected: 172.67.152.3:443 -> 192.168.11.20:49758 version: TLS 1.2
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD0FFE04_2_00007FF60AD0FFE0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF9FE04_2_00007FF60ACF9FE0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD174404_2_00007FF60AD17440
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF91E04_2_00007FF60ACF91E0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACE71A04_2_00007FF60ACE71A0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACDE3204_2_00007FF60ACDE320
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACDD7804_2_00007FF60ACDD780
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACD25404_2_00007FF60ACD2540
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD11C204_2_00007FF60AD11C20
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD49BA04_2_00007FF60AD49BA0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF3B804_2_00007FF60ACF3B80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4CB404_2_00007FF60AD4CB40
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD21CE04_2_00007FF60AD21CE0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD0DCC04_2_00007FF60AD0DCC0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACEB9404_2_00007FF60ACEB940
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACDA9404_2_00007FF60ACDA940
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACFCB004_2_00007FF60ACFCB00
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF6AE04_2_00007FF60ACF6AE0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD10A604_2_00007FF60AD10A60
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4AA404_2_00007FF60AD4AA40
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD360294_2_00007FF60AD36029
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD00FC04_2_00007FF60AD00FC0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACFCFC04_2_00007FF60ACFCFC0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD09FC04_2_00007FF60AD09FC0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACFDF804_2_00007FF60ACFDF80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4FF804_2_00007FF60AD4FF80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACD40E04_2_00007FF60ACD40E0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACE5DA04_2_00007FF60ACE5DA0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4AF004_2_00007FF60AD4AF00
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF7F204_2_00007FF60ACF7F20
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACDEEE04_2_00007FF60ACDEEE0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACEBE604_2_00007FF60ACEBE60
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4D4004_2_00007FF60AD4D400
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD0D3604_2_00007FF60AD0D360
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACFF3604_2_00007FF60ACFF360
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD1D5004_2_00007FF60AD1D500
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD4D2004_2_00007FF60AD4D200
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD001804_2_00007FF60AD00180
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACEA2E04_2_00007FF60ACEA2E0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACEB2804_2_00007FF60ACEB280
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACF22A04_2_00007FF60ACF22A0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD208204_2_00007FF60AD20820
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD2C7E04_2_00007FF60AD2C7E0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD507A04_2_00007FF60AD507A0
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD097804_2_00007FF60AD09780
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD069004_2_00007FF60AD06900
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACEF6604_2_00007FF60ACEF660
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: String function: 00007FF60AD0AD00 appears 687 times
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: String function: 00007FF60AD0A4E0 appears 88 times
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: String function: 00007FF60AD089E0 appears 516 times
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: String function: 00007FF60AD08AC0 appears 31 times
Source: classification engineClassification label: mal56.evad.mine.win@5/2@1/1
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4700:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4700:120:WilError_03
Source: C:\Users\user\Desktop\download\pdf-ez.exeFile opened: C:\Windows\system32\93d22dc41d1a7fb2d3de7b51de99faa80925ede8bdadf4c2a6bbad7e6b8c759aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: pdf-ez.exeString found in binary or memory: key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: pdf-ez.exeString found in binary or memory: key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: pdf-ez.exeString found in binary or memory: ) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: pdf-ez.exeString found in binary or memory: ) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: pdf-ez.exeString found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser are
Source: pdf-ez.exeString found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser are
Source: pdf-ez.exeString found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: pdf-ez.exeString found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: pdf-ez.exeString found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: pdf-ez.exeString found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: pdf-ez.exeString found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: pdf-ez.exeString found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: pdf-ez.exeString found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: pdf-ez.exeString found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: pdf-ez.exeString found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: pdf-ez.exeString found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: pdf-ez.exeString found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: pdf-ez.exeString found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: pdf-ez.exeString found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: pdf-ez.exeString found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: pdf-ez.exeString found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: pdf-ez.exeString found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: pdf-ez.exeString found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: pdf-ez.exeString found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: pdf-ez.exeString found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: pdf-ez.exeString found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: pdf-ez.exeString found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: pdf-ez.exeString found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: pdf-ez.exeString found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: pdf-ez.exeString found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe"
Source: unknownProcess created: C:\Users\user\Desktop\download\pdf-ez.exe "C:\Users\user\Desktop\download\pdf-ez.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
Source: Binary string: WebView2Loader.dll.pdb source: pdf-ez.exe, 00000004.00000000.201075089443.00007FF60AEF7000.00000008.00000001.01000000.00000003.sdmp, pdf-ez.exe, 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmp, pdf-ez.exe.2.dr
Source: pdf-ez.exe.2.drStatic PE information: section name: .00cfg
Source: C:\Windows\SysWOW64\wget.exeFile created: C:\Users\user\Desktop\download\pdf-ez.exeJump to dropped file
Source: C:\Users\user\Desktop\download\pdf-ez.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD38D80 rdtscp4_2_00007FF60AD38D80
Source: C:\Users\user\Desktop\download\pdf-ez.exeAPI coverage: 5.9 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe, 00000004.00000002.201076741055.00000245BE692000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

barindex
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD38D80 Start: 00007FF60AD38D89 End: 00007FF60AD38D9F4_2_00007FF60AD38D80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60AD38D80 rdtscp4_2_00007FF60AD38D80
Source: C:\Users\user\Desktop\download\pdf-ez.exeCode function: 4_2_00007FF60ACD1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,4_2_00007FF60ACD1160
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\wget.exeQueries volume information: C:\Users\user\Desktop\download VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping111
Security Software Discovery		Remote Services1
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://pdf-ezy.com/pdf-ez.exe0%Avira URL Cloudsafe

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Desktop\download\pdf-ez.exe16%ReversingLabsWin64.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://pdf-ezy.com/pdf-ez.exeM0%Avira URL Cloudsafe
http://ocsps.ssl.com00%Avira URL Cloudsafe
https://static.pdf-ezy.comUTF16From0%Avira URL Cloudsafe
http://ocsp.sectigo.com00%Avira URL Cloudsafe
https://pdf-ezy.com/pdf-ez.exeur0%Avira URL Cloudsafe
https://static.pdf-ezy.comUTF16FromString0%Avira URL Cloudsafe
http://ocsps.ssl.com0_0%Avira URL Cloudsafe
https://pdf-ezy.com/pdf-ez.exeL0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
pdf-ezy.com
172.67.152.3
truefalse
    		unknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    https://pdf-ezy.com/pdf-ez.exefalse
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0pdf-ez.exe.2.drfalse
        		high
        https://pdf-ezy.com/pdf-ez.exeLwget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://pdf-ezy.com/pdf-ez.exeMwget.exe, 00000002.00000002.201063601665.0000000001530000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
          		high
          https://sectigo.com/CPS0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
            		high
            http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
              		high
              http://ocsp.sectigo.com0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0zwget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
                		high
                https://static.pdf-ezy.comUTF16FromStringpdf-ez.exe, pdf-ez.exe, 00000004.00000000.201074719258.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmp, pdf-ez.exe, 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmp, pdf-ez.exe.2.drfalse
                • Avira URL Cloud: safe
                		unknown
                https://www.ssl.com/repository0pdf-ez.exe.2.drfalse
                  		high
                  http://ocsps.ssl.com0_pdf-ez.exe.2.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://static.pdf-ezy.comUTF16Frompdf-ez.exefalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsps.ssl.com0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.quovadis.bmwget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://www.quovadis.bm0wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0pdf-ez.exe.2.drfalse
                        		high
                        http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
                          		high
                          https://pdf-ezy.com/pdf-ez.exeurwget.exe, 00000002.00000002.201063601665.0000000001530000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://ocsp.quovadisoffshore.com0wget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063362113.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062873041.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063816299.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201062761186.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
                              		high
                              https://ocsp.quovadisoffshore.comwget.exe, 00000002.00000003.201062795115.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.201063687666.0000000002E9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#wget.exe, 00000002.00000003.201061474582.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.201061474582.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, pdf-ez.exe.2.drfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  172.67.152.3
                                  		pdf-ezy.comUnited States
                                  		13335CLOUDFLARENETUSfalse

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1581050
                                  Start date and time:2024-12-26 20:43:38 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 4m 13s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:urldownload.jbs
                                  Sample URL:https://pdf-ezy.com/pdf-ez.exe
                                  Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                  Number of analysed new started processes analysed:6
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Detection:MAL
                                  Classification:mal56.evad.mine.win@5/2@1/1
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 98%
                                  • Number of executed functions: 10
                                  • Number of non-executed functions: 46
                                  Cookbook Comments:
                                  • Stop behavior analysis, all processes terminated

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                  • VT rate limit hit for: https://pdf-ezy.com/pdf-ez.exe

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  ⊘No context

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\Users\user\Desktop\cmdline.out

                                  Download File
                                  Process:C:\Windows\SysWOW64\cmd.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:modified
                                  Size (bytes):4472
                                  Entropy (8bit):2.675424700904136
                                  Encrypted:false
                                  SSDEEP:48:Yw6t0g0kXFgz13PHI47EQp+aI8tLUExZQ0Oy:ssVfIkvQy
                                  MD5:0973A58DED70E830E95419914EAB42F9
                                  SHA1:FCF856B12F949342E9096CBE120C50D0DD3FCFBF
                                  SHA-256:DFEE235AEAD4A2D7AB038F4FD138EA6401B0CBA6C17BBE699417CE72D28405AF
                                  SHA-512:6511E14EE89F7CADC2F6BF810D82FF39A2CC2248C873C19263A3684DDB0698B6E886529A52A9F286B973B8BFB5B4512DFB7832820DECC63729CBFC663684D323
                                  Malicious:false
                                  Reputation:low
                                  Preview:--2024-12-26 14:45:47-- https://pdf-ezy.com/pdf-ez.exe..Resolving pdf-ezy.com (pdf-ezy.com)... 172.67.152.3, 104.21.40.135..Connecting to pdf-ezy.com (pdf-ezy.com)|172.67.152.3|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 2631856 (2.5M) [application/octet-stream]..Saving to: 'C:/Users/user/Desktop/download/pdf-ez.exe'.... 0K .......... .......... .......... .......... .......... 1% 559K 5s.. 50K .......... .......... .......... .......... .......... 3% 1.43M 3s.. 100K .......... .......... .......... .......... .......... 5% 583K 3s.. 150K .......... .......... .......... .......... .......... 7% 2.05M 3s.. 200K .......... .......... .......... .......... .......... 9% 3.17M 2s.. 250K .......... .......... .......... .......... .......... 11% 2.36M 2s.. 300K .......... .......... .......... .......... .......... 13% 2.01M 2s.. 350K .......... .......... .......... .......... .......... 15% 6.70M 2s.. 400K .......... ........

                                  C:\Users\user\Desktop\download\pdf-ez.exe

                                  Download File
                                  Process:C:\Windows\SysWOW64\wget.exe
                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):2631856
                                  Entropy (8bit):6.105549235278512
                                  Encrypted:false
                                  SSDEEP:24576:GQFfmjOsaIvRt9hdeX/bn4Y+jCepo81OC8cGLbt0E8T/B8G8Woo3qF+:BFfChaIvR/eXgjCepPCtuT/B+dK
                                  MD5:ADDD963C82C2AA246A853EE7CC114B00
                                  SHA1:09A3E5023C4887DBE1156DB7440425F55D13F3CB
                                  SHA-256:5058A3469D589BDF9279A128DB92C792C9AAA6C041AA20F07C4C090AB2152EFB
                                  SHA-512:1A530C0F74B808A0E7F67DFFD2B45229D78BE13999EF4FFAA68DBE8A91B09EA27B47CFFB25CDE88AF9F71DFEDE6C2B7490DB37A09DA2BC438DB579A9598D09C9
                                  Malicious:true
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 16%
                                  Reputation:low
                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d................."......<..........@..........@..............................0......*(...`..........................................\".N...f\".P....p/.........`o....(..$....0.X_..........................XS".(...XZ".8............_".(............................text...F:.......<.................. ..`.rdata.......P... ...@..............@..@.data....b...p"......`".............@....pdata..`o.......p...&&.............@..@.00cfg.......P/.......&.............@..@.tls.........`/.......&.............@....rsrc........p/.......&.............@..@.reloc..X_....0..`....'.............@..B........................................................................................................................................................................................................................................................................................................

                                  Static File Info

                                  ⊘No static file info

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Dec 26, 2024 20:45:47.944852114 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:47.944880962 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:47.945277929 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:47.947192907 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:47.947205067 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.151249886 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.151523113 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.153146982 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.153163910 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.153481960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.155386925 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.198211908 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398627996 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398700953 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398745060 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398787022 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398866892 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398916960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.398920059 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.398936033 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.399108887 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.399108887 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.399123907 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.399302006 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.399308920 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.399492025 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.399492025 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.403872967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404316902 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404361963 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404524088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404550076 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.404575109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404726028 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.404750109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.404897928 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.404913902 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.405018091 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.405157089 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.405180931 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.405464888 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.405487061 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.405487061 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.405509949 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.405706882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.406244040 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.406342030 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.406383991 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.406471014 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.406625986 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.406625986 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.406646967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.406996012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.410696030 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.410764933 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.410954952 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.410985947 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411206007 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.411220074 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411346912 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411732912 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411766052 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.411792040 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411806107 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.411952972 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.411966085 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.412149906 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.412149906 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.455780029 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.495486975 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.495670080 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.495738029 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.495759964 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.495779991 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.495924950 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.495924950 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.496148109 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.499588966 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.499782085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.499942064 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.500099897 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.500319958 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.500386000 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.500653982 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.500701904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.501030922 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.501039028 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.501070023 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.501260042 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.501310110 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.501579046 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.501622915 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.501753092 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.506412983 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.506599903 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.506695986 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.506867886 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.506867886 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.506927967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.507050991 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.507278919 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.507391930 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.507528067 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.507587910 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.507725954 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.507822990 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.507940054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.508124113 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.508124113 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.508171082 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.508316994 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.508557081 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.508745909 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.508795977 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.509063005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594165087 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.594417095 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.594515085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594567060 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.594633102 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.594718933 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594718933 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594718933 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594757080 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.594928026 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.594980955 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595022917 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595082045 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595158100 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595247030 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595345020 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595380068 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595432997 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595529079 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595571995 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595607042 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595607042 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595690966 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595793009 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595815897 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595837116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.595987082 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595987082 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595987082 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595987082 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.595999956 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596127033 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596214056 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596240997 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.596293926 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596431971 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.596431971 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.596577883 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596607924 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.596651077 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.596796036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.597166061 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.597379923 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.597430944 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.597593069 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.597635984 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.597666979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.597918987 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.597942114 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.597990990 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.598121881 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.598334074 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.598694086 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.598898888 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.598938942 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.599247932 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.599385977 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.599662066 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.599807024 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.600795984 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.600893974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.600966930 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.601147890 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.601170063 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.601821899 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.601941109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.602025032 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.602076054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.602173090 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.602266073 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.602266073 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.602415085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.602452993 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.603687048 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.603744030 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.604070902 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.604070902 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.604070902 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.604131937 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.604247093 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.605432034 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.605505943 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.605597973 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.605608940 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.605789900 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.605789900 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.607233047 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.607249975 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.607458115 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.607458115 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.607481003 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.607635975 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.608864069 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.608894110 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.609080076 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.609093904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.609240055 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.609240055 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.609452963 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.610707998 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.610738039 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.611052990 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.611071110 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.612576962 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.612600088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.612766981 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.612782001 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.612854004 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.613046885 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.626151085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.647274017 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.691940069 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.691962004 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.692307949 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.692307949 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.692327023 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.692497015 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.695137978 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.695158958 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.695353031 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.695440054 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.695456982 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.695599079 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.695647001 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.697798967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.697822094 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.698146105 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.698146105 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.698159933 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.698335886 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.699420929 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.699440002 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.699640036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.699640036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.699659109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.699722052 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.699953079 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.701157093 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.701173067 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.701373100 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.701373100 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.701394081 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.701615095 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.701615095 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.703448057 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.703464985 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.703789949 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.703811884 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.704175949 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.704606056 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.704622984 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.704756021 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.704808950 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.704817057 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.704987049 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.705178976 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.706552029 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.706568956 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.706921101 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.706921101 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.706921101 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.706921101 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.706943035 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.707295895 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.708071947 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.708090067 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.708241940 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.708482981 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.708482981 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.708492994 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.708777905 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.709566116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.709582090 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.709745884 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.709954023 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.709954023 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.709965944 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.710103035 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.710540056 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.710557938 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.710716963 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.710923910 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.710923910 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.710942030 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.711146116 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.711850882 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.711868048 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.712059975 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.712146044 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.712157011 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.712306023 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.712502003 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.712939978 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.712956905 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.713135958 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713135958 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713135958 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713149071 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.713324070 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713541985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713541985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713541985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.713743925 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.713761091 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.713905096 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.714088917 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.714095116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.714306116 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.715675116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.715694904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.716130972 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.716145039 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.716325998 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.717317104 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.717334032 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.717776060 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.717793941 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.718156099 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.718874931 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.718893051 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.719055891 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.719286919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.719286919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.719306946 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.719486952 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.720318079 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.720451117 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.720699072 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.720699072 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.720705986 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.721071005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.721322060 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.722218037 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.722229004 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.722574949 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.722588062 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.722795010 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.722795010 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.723938942 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.723949909 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.724148989 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.724148989 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.724158049 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.724211931 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.724585056 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.725641012 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.725651979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.725816965 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.726022959 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.726031065 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.726171017 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.727041960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.727056026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.727263927 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.727272034 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.727448940 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.727730036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.729486942 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.729501009 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.729866028 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.729875088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.730272055 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.730900049 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.730914116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.731126070 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.731126070 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.731138945 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.731295109 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.731503963 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.732599974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.732611895 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.732960939 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.732960939 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.732968092 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.733324051 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.734349966 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.734360933 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.734548092 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.734730005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.734730005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.734730005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.734736919 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.734918118 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.736437082 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.736449957 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.736892939 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.736903906 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.737082005 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.738131046 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.738142014 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.738349915 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.738362074 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.738425970 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.738621950 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.739341974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.739356041 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.739567995 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.739613056 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.739618063 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.739871979 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.786103964 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.786123991 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.786350012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.786369085 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.786537886 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.786725044 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.787400961 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.787420988 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.787632942 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.787651062 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.787785053 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.788003922 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.789180040 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.789199114 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.789524078 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.789541960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.789740086 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.790915012 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.790935993 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.791131973 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.791131973 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.791152000 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.791379929 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.791433096 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.792537928 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.792557955 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.792881012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.792881012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.792881012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.792897940 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.793286085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.793674946 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.793694973 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.793842077 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.794058084 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.794064999 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.794440985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.795571089 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.795589924 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.795984983 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.796001911 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.796361923 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.797521114 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.797537088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.797777891 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.797796011 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.797988892 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.797988892 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.799693108 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.799709082 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.799988031 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.800012112 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.800379992 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.801122904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.801137924 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.801300049 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.801532984 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.801532984 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.801552057 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.801723957 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.802483082 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.802501917 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.802700996 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.802782059 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.802793980 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.802962065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.803133011 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.804245949 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.804265022 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.804476023 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.804493904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.804661036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.804856062 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.806997061 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.807017088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.807291985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.807311058 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.807658911 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.808312893 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.808331966 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.808716059 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.808716059 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.808731079 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.808881998 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.809689045 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.809705019 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.809900999 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.809900999 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.809967041 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.809973955 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.810363054 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.812520981 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.812541008 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.812674999 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.812752962 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.812761068 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.812939882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.813036919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.813910007 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.813925982 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.814057112 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.814105988 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.814112902 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.814291954 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.814291954 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.815597057 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.815613985 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.815901041 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.815901041 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.815920115 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.816267967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.817334890 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.817353010 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.817482948 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.817568064 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.817568064 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.817588091 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.817735910 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.817929983 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.819371939 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.819389105 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.819751978 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.819751978 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.819771051 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.819808006 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.820118904 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.820137024 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.821284056 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.821304083 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.821657896 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.821657896 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.821672916 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.823003054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.823018074 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.823177099 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.823189974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.823376894 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.823376894 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.824810028 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.824826002 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.825150967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.825150967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.825165987 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.826658010 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.826677084 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.826848030 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.826859951 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.826957941 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.827145100 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.828919888 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.828936100 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.829082012 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.829261065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.829261065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.829261065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.829271078 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.831310034 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.831327915 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.831557035 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.831569910 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.831624031 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.833452940 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.833467960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.833591938 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.833604097 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.833832979 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.835278034 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.835293055 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.835438967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.835642099 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.835653067 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.836451054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.836469889 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.836662054 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.836674929 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.836757898 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.836918116 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.837699890 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.837716103 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.837891102 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.837903023 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.838078976 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.838078976 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.839436054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.839456081 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.839792967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.839792967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.839807987 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.840591908 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.840606928 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.840753078 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.840765953 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.840970039 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.840970039 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.841864109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.841881037 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.842025042 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.842277050 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.842288017 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.843696117 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.843714952 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.843908072 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.843920946 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.843976021 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.844167948 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.845067978 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.845082998 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.845231056 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.845242977 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.845421076 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.846503019 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.846518993 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.846868038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.846868038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.846882105 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.848247051 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.848272085 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.848458052 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.848470926 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.848732948 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.849534035 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.849549055 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.849704027 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.849716902 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.849919081 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.850786924 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.850802898 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.850923061 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.851150990 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.851161003 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.851747990 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.851766109 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.852047920 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.852060080 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.852238894 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.853867054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.853882074 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.854048014 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.854060888 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.854221106 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.854412079 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.855777979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.855793953 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.856122017 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.856122017 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.856134892 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.857230902 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.857249975 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.857419014 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.857429981 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.857506037 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.857697964 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.858480930 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.858496904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.858642101 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.858891010 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.858897924 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.859879017 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.859896898 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.860070944 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.860080004 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.860153913 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.860348940 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.861150026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.861165047 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.861504078 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.861504078 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.861525059 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.862752914 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.862771988 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.862898111 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.862915039 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.863142967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.863142967 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.863979101 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.863995075 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.864166975 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.864343882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.864343882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.864356995 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.865303993 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.865329981 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.865490913 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.865500927 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.865601063 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.865767956 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.866455078 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.866471052 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.866600990 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.866626024 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.866835117 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.866852999 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.867023945 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.867325068 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.867343903 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.867516041 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.867527008 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.867600918 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.867794991 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.868947029 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.868962049 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.869110107 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.869110107 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.869287968 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.869293928 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.869507074 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.870702028 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.870721102 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.870893002 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.870910883 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.871005058 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.871165991 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.871881962 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.871897936 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.872044086 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.872055054 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.872236013 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.873377085 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.873471975 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.873554945 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.873738050 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.873747110 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.882019997 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.882039070 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.882404089 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.882404089 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.882424116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.882961035 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.882980108 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.883496046 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.883513927 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.883536100 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.884138107 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.884138107 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.884157896 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.884603024 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.884603024 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.884649038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.884718895 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.884740114 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.885126114 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.885134935 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.885507107 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.885514975 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.885523081 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.885670900 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.885689974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.885941029 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.885941029 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.885953903 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.886214018 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.886894941 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.886913061 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.887070894 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.887116909 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.887129068 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.887278080 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.887490034 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.888030052 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.888046980 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.888374090 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.888386011 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.888755083 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.889229059 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.889245033 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.889461040 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.889478922 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.889647961 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.889836073 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.889952898 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.889969110 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.890355110 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.890355110 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.890368938 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.890734911 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.891443968 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.891458988 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.891665936 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.891665936 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.891680002 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.891848087 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.892035007 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.892416954 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.892432928 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.892760992 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.892760992 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.892774105 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.892952919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.893141985 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.893537045 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.893553972 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.893676043 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.893728018 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.893737078 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.894069910 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.894069910 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.894396067 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.894412041 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.894768953 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.894768953 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.894782066 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.894953966 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.894953966 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.895620108 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.895638943 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.895920038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.895920038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.895930052 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.896270037 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.896919966 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.896936893 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.897125006 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.897135019 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.897306919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.897512913 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.897805929 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.897821903 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.898109913 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.898119926 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.898433924 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.898499966 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.898509979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.898641109 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.898641109 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.898650885 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.898860931 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.898869991 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.899038076 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.899482012 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.899498940 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.899648905 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.899904013 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.899913073 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.900213957 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.900286913 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.900293112 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.900419950 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.900615931 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.901732922 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.901757002 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.901948929 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.901957989 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.902206898 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.902206898 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.902896881 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.902916908 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.903259039 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.903270006 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.903454065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.903454065 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.903878927 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.903907061 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.904153109 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.904162884 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.904340982 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.904522896 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.905546904 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.905563116 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.906646013 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.906656981 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.906668901 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.907286882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.907286882 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.908065081 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.908081055 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.908226013 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.908482075 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.908492088 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.908746958 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.908765078 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.908960104 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.908967018 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.909022093 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.909214973 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.909357071 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.909372091 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.909473896 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.909574986 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.909584045 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.909761906 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.910052061 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.910069942 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.910263062 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.910273075 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.910346031 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.910520077 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.911103010 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.911122084 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.911480904 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.911480904 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.911490917 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.912363052 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.912384033 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.912717104 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.912718058 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.912718058 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.912729979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.913224936 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.913239002 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.913386106 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.913393021 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.913578987 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.913578987 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.914354086 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.914371014 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.914515018 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.914697886 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.914704084 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.915261984 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.915281057 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.915537119 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.915537119 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.915545940 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.916380882 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.916395903 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.916544914 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.916553020 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.916737080 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.916949034 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.917319059 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.917335033 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.917483091 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.917705059 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.917714119 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.918464899 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.918488026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.918651104 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.918663979 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.918740988 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.918932915 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.919373035 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.919393063 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.919714928 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.919714928 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.919729948 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.920727015 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.920747995 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.921600103 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.921601057 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.921617985 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.921633959 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.921650887 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.921981096 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.922233105 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.922245026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.923079967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.923099995 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.923240900 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.923254967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.923623085 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.923966885 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.923985004 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.924128056 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.924313068 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.924326897 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.925079107 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.925098896 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.926223993 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.926244974 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.926433086 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.926433086 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.926450014 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.927155972 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.927175045 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.927196026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.927611113 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.927611113 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.927627087 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.927774906 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.928065062 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.928137064 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.928154945 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.928508043 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.928519964 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.928889036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.929564953 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.929584026 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.929769039 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.929780006 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.929954052 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.930135965 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.931065083 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.931086063 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.931474924 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.931493998 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.931833029 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.932904959 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.932923079 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.933104038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.933104038 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.933283091 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.933291912 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.933507919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.933507919 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.934082985 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.934098959 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.934295893 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.934381962 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.934381962 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.934400082 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.934614897 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.934869051 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.934887886 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.935213089 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.935224056 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.935405970 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.935622931 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.935993910 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.936011076 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.936192036 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.936204910 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.936395884 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.936593056 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.937216997 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.937232971 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.937630892 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.937650919 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.938282967 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.938302040 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.938775063 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.938792944 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.939225912 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.939608097 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.939719915 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.939735889 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.939882040 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.940221071 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.940232038 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.940665960 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.940666914 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.940677881 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.940757036 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.941052914 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.941071987 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.941323042 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.942245960 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.942261934 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.942574024 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.942588091 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.942943096 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.942992926 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.943061113 CET44349758172.67.152.3192.168.11.20
                                  Dec 26, 2024 20:45:48.943249941 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.943758011 CET49758443192.168.11.20172.67.152.3
                                  Dec 26, 2024 20:45:48.943773031 CET44349758172.67.152.3192.168.11.20

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Dec 26, 2024 20:45:47.753865004 CET5897853192.168.11.201.1.1.1
                                  Dec 26, 2024 20:45:47.938648939 CET53589781.1.1.1192.168.11.20

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Dec 26, 2024 20:45:47.753865004 CET192.168.11.201.1.1.10x985cStandard query (0)pdf-ezy.comA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Dec 26, 2024 20:45:47.938648939 CET1.1.1.1192.168.11.200x985cNo error (0)pdf-ezy.com172.67.152.3A (IP address)IN (0x0001)false
                                  Dec 26, 2024 20:45:47.938648939 CET1.1.1.1192.168.11.200x985cNo error (0)pdf-ezy.com104.21.40.135A (IP address)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • pdf-ezy.com

                                  HTTPS Proxied Packets

                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                  0192.168.11.2049758172.67.152.34434268C:\Windows\SysWOW64\wget.exe
                                  TimestampBytes transferredDirectionData
                                  2024-12-26 19:45:48 UTC197OUTGET /pdf-ez.exe HTTP/1.1
                                  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
                                  Accept: */*
                                  Accept-Encoding: identity
                                  Host: pdf-ezy.com
                                  Connection: Keep-Alive
                                  2024-12-26 19:45:48 UTC1173INHTTP/1.1 200 OK
                                  Date: Thu, 26 Dec 2024 19:45:48 GMT
                                  Content-Type: application/octet-stream
                                  Content-Length: 2631856
                                  Connection: close
                                  Access-Control-Allow-Origin: pdf-ezy.com
                                  Access-Control-Allow-Headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
                                  Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD
                                  Access-Control-Allow-Credentials: true
                                  Cache-Control: no-store
                                  Etag: "09a3e5023c4887dbe1156db7440425f55d13f3cb"
                                  cf-cache-status: DYNAMIC
                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3kHLzhQXF864SCm1utQVrH1oq0nEPVX0WYT5DLipi4v9edVl4gSbQiYAq6tDgZskygY%2BRQu91%2FHOhi6a0UhBXIHBjLp%2FYPCZcGZYkHclK%2F%2FzWP3vQuamYc%2FfQTQhA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                  Server: cloudflare
                                  CF-RAY: 8f8392c50db442bc-EWR
                                  alt-svc: h3=":443"; ma=86400
                                  server-timing: cfL4;desc="?proto=TCP&rtt=94638&min_rtt=94574&rtt_var=20051&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=784&delivery_rate=40406&cwnd=252&unsent_bytes=0&cid=f6b7989103062780&ts=260&x=0"
                                  2024-12-26 19:45:48 UTC1369INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 08 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 3c 10 00 00 c4 17 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 30 00 00 04 00 00 f2 2a 28 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00
                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd"<@@0*(`
                                  2024-12-26 19:45:48 UTC1369INData Raw: 48 83 c4 28 c3 66 90 41 57 41 56 56 57 53 48 83 ec 20 65 48 8b 04 25 30 00 00 00 48 8b 78 08 48 8b 35 c9 3e 10 00 31 c0 f0 48 0f b1 3e 0f 94 c3 74 2e 48 39 c7 74 29 4c 8b 35 a1 4f 22 00 66 0f 1f 84 00 00 00 00 00 b9 e8 03 00 00 41 ff d6 31 c0 f0 48 0f b1 3e 0f 94 c3 74 05 48 39 c7 75 e7 48 8b 3d 90 3e 10 00 8b 07 83 f8 01 75 0c b9 1f 00 00 00 e8 ff 35 10 00 eb 27 83 3f 00 74 09 c6 05 b9 23 26 00 01 eb 19 c7 07 01 00 00 00 48 8b 0d 7a 3e 10 00 48 8b 15 7b 3e 10 00 e8 16 36 10 00 8b 07 83 f8 01 75 19 48 8b 0d 50 3e 10 00 48 8b 15 51 3e 10 00 e8 fc 35 10 00 c7 07 02 00 00 00 84 db 74 05 31 c0 48 87 06 48 8b 05 e6 3d 10 00 48 8b 00 48 85 c0 74 10 31 c9 ba 02 00 00 00 45 31 c0 ff 15 c6 3d 2f 00 e8 a9 d3 0f 00 48 8d 0d 32 d9 0f 00 ff 15 d4 4e 22 00 48 8b 0d e5
                                  Data Ascii: H(fAWAVVWSH eH%0HxH5>1H>t.H9t)L5O"fA1H>tH9uH=>u5'?t#&Hz>H{>6uHP>HQ>5t1HH=HHt1E1=/H2N"H
                                  2024-12-26 19:45:48 UTC1369INData Raw: 06 31 c9 31 d2 eb 0d 31 c0 31 db 5d c3 48 8d 4b 01 48 89 f8 48 8d 34 49 48 8d 34 71 48 89 c7 90 4c 8d 04 01 4d 8d 40 01 48 85 f6 7c 59 45 0f b6 00 45 89 c1 41 83 e0 7f 48 89 cb 48 89 f1 49 d3 e0 48 83 f9 40 48 19 f6 49 21 f0 4c 01 c2 41 f6 c1 80 75 b9 90 48 8d 04 03 48 8d 40 02 48 85 d2 7c 1f 48 89 c1 48 f7 d9 48 39 d1 72 05 48 89 d3 5d c3 48 85 c0 74 05 e8 b2 eb 05 00 e8 ed eb 05 00 e8 a8 eb 05 00 e8 83 5e 03 00 90 48 89 44 24 08 e8 98 58 06 00 48 8b 44 24 08 e9 4e ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 f0 00 00 00 55 48 89 e5 0f b6 10 f6 c2 02 74 06 31 c9 31 d2 eb 0d 31 c0 31 db 5d c3 48 8d 4b 01 48 89 f8 48 8d 34 49 48 8d 34 71 48 89 c7 90 4c 8d 04 01 4d 8d 40 01 0f 1f 00 48 85 f6 0f 8c ab 00 00 00 45 0f b6 00 45 89 c1 41
                                  Data Ascii: 1111]HKHH4IH4qHLM@H|YEEAHHIH@HI!LAuHH@H|HHH9rH]Ht^HD$XHD$NI;fUHt1111]HKHH4IH4qHLM@HEEA
                                  2024-12-26 19:45:48 UTC1369INData Raw: 00 00 e8 ce 76 06 00 4c 89 c8 b9 0a 00 00 00 e8 c1 76 06 00 4c 89 c8 b9 0a 00 00 00 e8 b4 76 06 00 31 c0 48 8d 1d 59 1b 14 00 48 89 cf be 00 04 00 00 4c 8d 05 ff a2 13 00 41 b9 03 00 00 00 b9 1b 00 00 00 e8 0c f6 04 00 e8 c7 a1 00 00 48 89 c3 48 8d 05 3d 24 11 00 e8 b8 61 03 00 48 8d 1d 22 21 14 00 b9 1c 00 00 00 48 89 c7 be 00 04 00 00 4c 8d 05 c0 a2 13 00 41 b9 03 00 00 00 31 c0 e8 d0 f5 04 00 e8 8b a1 00 00 48 89 c3 48 8d 05 01 24 11 00 90 e8 7b 61 03 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 40 88 74 24 28 44 88 44 24 29 e8 17 53 06 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c 24 20 0f b6 74 24 28 44 0f b6 44 24 29 e9 93 fb ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 48 83 ec 10 4d 8b
                                  Data Ascii: vLvLv1HYHLAHH=$aH"!HLA1HH${aHD$H\$HL$H|$ @t$(DD$)SHD$H\$HL$H|$ t$(DD$)UHHM
                                  2024-12-26 19:45:48 UTC1369INData Raw: 75 26 44 0f b7 1c 07 66 41 81 fb 61 6c 75 19 0f b6 7c 07 02 40 80 ff 6c 75 0e 48 8b 3d 33 1c 26 00 31 c0 e9 08 03 00 00 44 88 54 24 1f 48 8b 15 20 1c 26 00 48 89 54 24 40 31 c0 90 e9 bb 01 00 00 e8 d6 82 03 00 48 8d 05 95 cc 13 00 bb 10 00 00 00 e8 45 8b 03 00 48 8b 44 24 58 48 8b 5c 24 20 e8 36 8b 03 00 48 8d 05 34 32 14 00 bb 20 00 00 00 e8 25 8b 03 00 48 8b 44 24 60 48 8b 5c 24 48 e8 16 8b 03 00 48 8d 05 32 9d 13 00 bb 02 00 00 00 e8 05 8b 03 00 0f 1f 44 00 00 e8 db 82 03 00 48 8b 74 24 70 4c 8b 44 24 50 e9 0e fe ff ff 48 89 44 24 68 48 89 4c 24 28 66 90 e8 5b 82 03 00 48 8d 05 a4 37 14 00 bb 21 00 00 00 e8 ca 8a 03 00 48 8b 44 24 68 48 8b 5c 24 28 e8 bb 8a 03 00 48 8d 05 d7 9c 13 00 bb 02 00 00 00 e8 aa 8a 03 00 e8 85 82 03 00 48 8b 74 24 70 4c 8b 44
                                  Data Ascii: u&DfAalu|@luH=3&1DT$H &HT$@1HEHD$XH\$ 6H42 %HD$`H\$HH2DHt$pLD$PHD$hHL$(f[H7!HD$hH\$(HHt$pLD
                                  2024-12-26 19:45:48 UTC1369INData Raw: 0d fe 16 26 00 83 3d 37 66 2e 00 00 74 13 e8 70 68 06 00 49 89 03 48 8b 15 d6 16 26 00 49 89 53 08 48 89 05 cb 16 26 00 48 89 c2 8b 44 24 48 48 89 1d c5 16 26 00 4c 8d 43 fb 49 c1 e0 05 4a c7 44 02 08 06 00 00 00 42 c6 44 02 18 00 42 c6 44 02 19 00 83 3d e9 65 2e 00 00 74 18 4e 8b 0c 02 0f 1f 00 e8 1b 68 06 00 4d 89 0b 4e 8b 4c 02 10 4d 89 4b 08 4c 8d 0d b4 9d 13 00 4e 89 0c 02 4c 8d 0d ca 6b 2e 00 4e 89 4c 02 10 4a c7 44 02 28 04 00 00 00 42 c6 44 02 38 00 42 c6 44 02 39 00 83 3d 9c 65 2e 00 00 74 16 4e 8b 4c 02 20 e8 d0 67 06 00 4d 89 0b 4e 8b 4c 02 30 4d 89 4b 08 4c 8d 0d 43 9a 13 00 4e 89 4c 02 20 4c 8d 0d 81 6b 2e 00 4e 89 4c 02 30 4a c7 44 02 48 05 00 00 00 42 c6 44 02 58 00 42 c6 44 02 59 00 83 3d 50 65 2e 00 00 74 16 4e 8b 4c 02 40 e8 84 67 06 00
                                  Data Ascii: &=7f.tphIH&ISH&HD$HH&LCIJDBDBD=e.tNhMNLMKLNLk.NLJD(BD8BD9=e.tNL gMNL0MKLCNL Lk.NL0JDHBDXBDY=Pe.tNL@g
                                  2024-12-26 19:45:48 UTC1369INData Raw: 36 8b 44 24 08 0f 1f 44 00 00 85 c0 0f 84 54 02 00 00 89 44 24 44 b8 00 00 00 80 48 89 04 24 e8 66 02 00 00 45 0f 57 ff 4c 8b 35 3b 60 2e 00 65 4d 8b 36 4d 8b 36 8b 44 24 08 89 05 6a 5e 2e 00 48 c7 04 24 01 00 00 00 66 90 e8 3b 02 00 00 45 0f 57 ff 4c 8b 35 10 60 2e 00 65 4d 8b 36 4d 8b 36 8b 44 24 10 0f ba e0 00 0f 92 05 8a 66 2e 00 0f ba e0 01 0f 92 05 7b 66 2e 00 0f ba e0 09 0f 92 05 75 66 2e 00 0f ba e0 13 0f 92 05 6b 66 2e 00 0f ba e0 14 0f 92 05 61 66 2e 00 0f ba e0 17 0f 92 05 50 66 2e 00 0f ba e0 19 0f 92 05 38 66 2e 00 0f ba e0 0c 0f 92 c1 0f ba e0 1b 0f 92 c2 88 15 2f 66 2e 00 21 d1 88 0d 26 66 2e 00 0f ba e0 1b 72 06 31 c9 31 d2 eb 51 89 44 24 4c e8 c7 01 00 00 45 0f 57 ff 4c 8b 35 7c 5f 2e 00 65 4d 8b 36 4d 8b 36 8b 04 24 0f ba e0 01 73 09 0f
                                  Data Ascii: 6D$DTD$DH$fEWL5;`.eM6M6D$j^.H$f;EWL5`.eM6M6D$f.{f.uf.kf.af.Pf.8f./f.!&f.r11QD$LEWL5|_.eM6M6$s
                                  2024-12-26 19:45:48 UTC1369INData Raw: 18 48 8d 72 01 48 c1 e6 05 48 8b 7c 24 38 48 8b 1c 3e 4c 8b 44 24 30 4a 8b 04 06 4a 8b 4c 06 08 e8 8c 07 00 00 84 c0 75 95 eb 8b b8 01 00 00 00 90 eb 85 48 89 44 24 08 48 89 5c 24 10 e8 2f 3e 06 00 48 8b 44 24 08 48 8b 5c 24 10 0f 1f 44 00 00 e9 bb fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 08 48 39 0b 0f 94 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 08 48 39 0b 0f 94 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 c1 48 d1 e8 48 ba 55 55 55 55 55 55 55 55 48 21 d0 48 21 ca 48 8d 0c 02 48 89 ca 48 c1 e9 02 48 bb 33 33 33 33 33 33 33 33 48 21 d9 48 21 d3 48 01 d9 48 89 ca 48 c1 e9 04 48 01 d1 48 ba 0f 0f 0f 0f 0f 0f 0f 0f 48 21 ca 48 89 d1
                                  Data Ascii: HrHH|$8H>LD$0JJLuHD$H\$/>HD$H\$DHH9HH9HHHUUUUUUUUH!H!HHHH33333333H!H!HHHHHH!H
                                  2024-12-26 19:45:48 UTC1369INData Raw: 00 00 66 0f 1f 84 00 00 00 00 00 66 0f 1f 84 00 00 00 00 00 0f 1f 40 00 c5 fe 6f 17 c5 fe 6f 67 20 c5 ed 74 d9 c5 dd 74 e9 c5 fd d7 d3 c5 fd d7 cd f3 0f b8 d2 f3 0f b8 c9 49 01 d4 49 01 cc 48 83 c7 40 4c 39 df 7e d0 4c 39 ef 74 4d 4c 89 df c5 fe 6f 17 c5 fe 6f 67 20 c5 ed 74 d9 c5 dd 74 e9 c5 fd d7 d3 c5 fd d7 cd c5 f8 77 48 c1 e1 20 48 09 ca 48 83 e3 3f 48 c7 c1 40 00 00 00 48 29 d9 49 c7 c2 ff ff ff ff 49 d3 e2 4c 21 d2 f3 48 0f b8 d2 49 01 d4 4d 89 20 c3 c5 f8 77 4d 89 20 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 80 3d 86 5b 2e 00 01 74 05 e9 92 06 00 00 48 8b 74 24 08 48 8b 5c 24 10 8a 44 24 18 4c 8d 44 24 20 e9 fa fd ff ff cc cc cc cc cc cc cc cc cc cc 48 83 fb 08 0f 82 08 01 00 00 48 83 fb 40 0f 82 cc 00 00 00 80 3d 38
                                  Data Ascii: ff@oog ttIIH@L9~L9tMLoog ttwH HH?H@H)IIL!HIM wM =[.tHt$H\$D$LD$ HH@=8
                                  2024-12-26 19:45:48 UTC1369INData Raw: f3 41 0f 6f 08 48 8d 74 17 f1 49 c7 c1 10 00 00 00 49 29 c1 66 0f 1f 84 00 00 00 00 00 66 90 66 0f 3a 61 0f 0c 4c 39 c9 76 18 4c 01 cf 48 39 f7 72 ed 66 0f 3a 61 4e ff 0c 4c 39 c9 77 8f 48 8d 7e ff 48 01 cf 4c 29 d7 49 89 3b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 7c 24 08 48 8b 54 24 10 4c 8b 44 24 18 48 8b 44 24 20 49 89 fa 4c 8d 5c 24 28 e9 bf fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 48 0f 6e c0 66 0f 60 c0 66 0f 60 c0 66 0f 70 c0 00 48 83 fb 10 7c 58 48 89 f7 48 83 fb 20 0f 87 91 00 00 00 48 8d 44 1e f0 eb 19 0f 1f 40 00 f3 0f 6f 0f 66 0f 74 c8 66 0f d7 d1 0f bc d2 75 25 48 83 c7 10 48 39 c7 72 e6 48 89 c7 f3 0f 6f 08 66 0f 74 c8 66 0f d7 d1 0f bc d2 75 08 49 c7
                                  Data Ascii: AoHtII)fff:aL9vLH9rf:aNL9wH~HL)I;H|$HT$LD$HD$ IL\$(fHnf`f`fpH|XHH HD@oftfu%HH9rHoftfuI


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:14:45:47
                                  Start date:26/12/2024
                                  Path:C:\Windows\SysWOW64\cmd.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe" > cmdline.out 2>&1
                                  Imagebase:0xf20000
                                  File size:236'544 bytes
                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:1
                                  Start time:14:45:47
                                  Start date:26/12/2024
                                  Path:C:\Windows\System32\conhost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  Imagebase:0x7ff74f3e0000
                                  File size:875'008 bytes
                                  MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:2
                                  Start time:14:45:47
                                  Start date:26/12/2024
                                  Path:C:\Windows\SysWOW64\wget.exe
                                  Wow64 process (32bit):true
                                  Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://pdf-ezy.com/pdf-ez.exe"
                                  Imagebase:0x400000
                                  File size:3'895'184 bytes
                                  MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:4
                                  Start time:14:45:49
                                  Start date:26/12/2024
                                  Path:C:\Users\user\Desktop\download\pdf-ez.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Users\user\Desktop\download\pdf-ez.exe"
                                  Imagebase:0x7ff60acd0000
                                  File size:2'631'856 bytes
                                  MD5 hash:ADDD963C82C2AA246A853EE7CC114B00
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:Go lang
                                  Antivirus matches:
                                  • Detection: 16%, ReversingLabs
                                  Reputation:low
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:1%
                                    Dynamic/Decrypted Code Coverage:0%
                                    Signature Coverage:17.2%
                                    Total number of Nodes:790
                                    Total number of Limit Nodes:64
                                    execution_graph 45189 7ff60ad04d40 45190 7ff60ad04d4a 45189->45190 45190->45189 45211 7ff60ad04380 45190->45211 45200 7ff60ad04d96 45241 7ff60ad042e0 45200->45241 45204 7ff60ad04daa 45263 7ff60ad04820 45204->45263 45206 7ff60ad04daf 45270 7ff60ad062e0 45206->45270 45215 7ff60ad0438a 45211->45215 45212 7ff60ad089e0 LoadLibraryExW 45212->45215 45213 7ff60ad04220 LoadLibraryExW 45213->45215 45214 7ff60ad063e0 LoadLibraryExW 45214->45215 45215->45211 45215->45212 45215->45213 45215->45214 45216 7ff60ad04650 45215->45216 45217 7ff60ad1c2a0 45216->45217 45219 7ff60ad1c2aa 45217->45219 45219->45217 45277 7ff60ad06200 45219->45277 45221 7ff60ad062e0 LoadLibraryExW 45222 7ff60ad1c2e5 45221->45222 45223 7ff60ad06360 LoadLibraryExW 45222->45223 45224 7ff60ad1c325 45223->45224 45225 7ff60ad062e0 LoadLibraryExW 45224->45225 45226 7ff60ad04d85 45225->45226 45227 7ff60ad1c400 45226->45227 45229 7ff60ad1c40a 45227->45229 45228 7ff60ad06360 LoadLibraryExW 45230 7ff60ad1c437 45228->45230 45229->45227 45229->45228 45231 7ff60ad06360 LoadLibraryExW 45230->45231 45232 7ff60ad1c46e 45231->45232 45233 7ff60ad06360 LoadLibraryExW 45232->45233 45234 7ff60ad04d8a 45233->45234 45235 7ff60ad049e0 45234->45235 45236 7ff60ad049ea 45235->45236 45236->45235 45295 7ff60ad06460 45236->45295 45239 7ff60ad062e0 LoadLibraryExW 45240 7ff60ad04a53 45239->45240 45276 7ff60ad04920 LoadLibraryExW 45240->45276 45243 7ff60ad042ea 45241->45243 45242 7ff60ad06360 LoadLibraryExW 45242->45243 45243->45241 45243->45242 45244 7ff60ad0433b 45243->45244 45298 7ff60ad089e0 LoadLibraryExW 45243->45298 45246 7ff60ad04a80 45244->45246 45252 7ff60ad04a8a 45246->45252 45248 7ff60ad04bae 45248->45204 45249 7ff60ad06200 LoadLibraryExW 45249->45252 45252->45246 45252->45248 45252->45249 45253 7ff60ad04c59 45252->45253 45302 7ff60ad063e0 45252->45302 45305 7ff60ad04e60 LoadLibraryExW 45252->45305 45306 7ff60ad19c80 LoadLibraryExW 45252->45306 45299 7ff60ad065e0 45253->45299 45255 7ff60ad04c93 45256 7ff60ad04cf0 45255->45256 45307 7ff60ad0a480 LoadLibraryExW 45255->45307 45256->45204 45258 7ff60ad04cd3 45308 7ff60ad0ad00 LoadLibraryExW 45258->45308 45260 7ff60ad04ce5 45309 7ff60ad0a4e0 LoadLibraryExW 45260->45309 45262 7ff60ad04cea 45262->45204 45264 7ff60ad0482a 45263->45264 45264->45263 45265 7ff60ad063e0 LoadLibraryExW 45264->45265 45268 7ff60ad04871 45265->45268 45266 7ff60ad062e0 LoadLibraryExW 45267 7ff60ad048bd 45266->45267 45267->45206 45268->45266 45269 7ff60ad0490b 45268->45269 45269->45206 45271 7ff60ad06200 LoadLibraryExW 45270->45271 45272 7ff60ad04de5 45271->45272 45273 7ff60ad06360 45272->45273 45274 7ff60ad06200 LoadLibraryExW 45273->45274 45275 7ff60ad04e25 45274->45275 45276->45200 45278 7ff60ad0621c 45277->45278 45281 7ff60ad38ac0 45278->45281 45280 7ff60ad0627b 45280->45221 45282 7ff60ad38b47 45281->45282 45283 7ff60ad38ae5 45281->45283 45284 7ff60ad38aa0 LoadLibraryExW 45282->45284 45283->45282 45285 7ff60ad38afa 45283->45285 45286 7ff60ad38b61 45284->45286 45289 7ff60ad38aa0 45285->45289 45286->45280 45292 7ff60ad3a620 45289->45292 45290 7ff60ad38aad 45290->45280 45294 7ff60ad3a640 LoadLibraryExW 45292->45294 45294->45290 45296 7ff60ad06200 LoadLibraryExW 45295->45296 45297 7ff60ad04a1b 45296->45297 45297->45239 45297->45240 45298->45243 45300 7ff60ad06200 LoadLibraryExW 45299->45300 45301 7ff60ad06636 45300->45301 45301->45255 45303 7ff60ad06200 LoadLibraryExW 45302->45303 45304 7ff60ad06436 45303->45304 45304->45252 45305->45252 45306->45252 45307->45258 45308->45260 45309->45262 45310 7ff60acdf0c0 45311 7ff60acdf0c6 45310->45311 45311->45310 45314 7ff60acdf100 45311->45314 45313 7ff60acdf0e8 45318 7ff60acdf10a 45314->45318 45315 7ff60ad089e0 LoadLibraryExW 45315->45318 45316 7ff60acdf145 45317 7ff60acdf21b 45316->45317 45319 7ff60acdf156 45316->45319 45320 7ff60ace7b60 LoadLibraryExW 45317->45320 45318->45314 45318->45315 45318->45316 45322 7ff60acdf18a 45319->45322 45341 7ff60acdcae0 LoadLibraryExW 45319->45341 45321 7ff60acdf225 45320->45321 45321->45313 45328 7ff60acdf216 45322->45328 45336 7ff60ace7b60 45322->45336 45326 7ff60acdf289 45330 7ff60acdf2c5 45326->45330 45343 7ff60ad02ec0 45326->45343 45327 7ff60acdf330 45362 7ff60ad089e0 LoadLibraryExW 45327->45362 45363 7ff60acdcd40 LoadLibraryExW 45327->45363 45328->45326 45342 7ff60acdcd40 LoadLibraryExW 45328->45342 45330->45313 45335 7ff60ad02ec0 LoadLibraryExW 45335->45330 45337 7ff60ad02ec0 LoadLibraryExW 45336->45337 45338 7ff60ace7b7b 45337->45338 45339 7ff60ad06460 LoadLibraryExW 45338->45339 45340 7ff60acdf205 45339->45340 45340->45327 45340->45328 45341->45322 45342->45326 45344 7ff60ad02ee5 45343->45344 45345 7ff60acdf2b0 45344->45345 45364 7ff60ad0a480 LoadLibraryExW 45344->45364 45345->45335 45347 7ff60ad02f05 45365 7ff60ad0ad00 LoadLibraryExW 45347->45365 45349 7ff60ad02f16 45366 7ff60ad0aa40 LoadLibraryExW 45349->45366 45351 7ff60ad02f25 45367 7ff60ad0ad00 LoadLibraryExW 45351->45367 45353 7ff60ad02f36 45368 7ff60ad0ab20 LoadLibraryExW 45353->45368 45355 7ff60ad02f45 45369 7ff60ad0a6c0 LoadLibraryExW 45355->45369 45357 7ff60ad02f4a 45370 7ff60ad0a4e0 LoadLibraryExW 45357->45370 45359 7ff60ad02f4f 45371 7ff60ad089e0 LoadLibraryExW 45359->45371 45361 7ff60ad02f65 45362->45327 45363->45327 45364->45347 45365->45349 45366->45351 45367->45353 45368->45355 45369->45357 45370->45359 45371->45361 45372 7ff60ad36c40 45373 7ff60ad36c82 45372->45373 45376 7ff60ad3da80 45373->45376 45375 7ff60ad36d89 45379 7ff60ad14c40 45376->45379 45381 7ff60ad14c46 45379->45381 45381->45379 45383 7ff60ad36ec0 45381->45383 45382 7ff60ad14c8b 45382->45375 45384 7ff60ad36ee1 45383->45384 45386 7ff60ad36f3f 45383->45386 45384->45386 45390 7ff60acf9bc0 45384->45390 45396 7ff60ad14cc0 45384->45396 45404 7ff60ad30b00 45384->45404 45385 7ff60ad36f09 45385->45382 45386->45382 45392 7ff60acf9bc6 45390->45392 45391 7ff60acf9c06 45408 7ff60acf9fe0 45391->45408 45392->45390 45392->45391 45442 7ff60acf9360 LoadLibraryExW 45392->45442 45395 7ff60acf9c1c 45395->45385 45398 7ff60ad14cc6 45396->45398 45398->45396 45628 7ff60ad14d20 LoadLibraryExW 45398->45628 45399 7ff60ad14cdf 45629 7ff60ad18e20 LoadLibraryExW 45399->45629 45401 7ff60ad14cfa 45402 7ff60ad14d08 45401->45402 45614 7ff60ad10340 45401->45614 45402->45385 45406 7ff60ad30b06 45404->45406 45405 7ff60ad0f760 LoadLibraryExW 45407 7ff60ad30b25 45405->45407 45406->45404 45406->45405 45407->45385 45418 7ff60acf9fef 45408->45418 45409 7ff60acdcae0 LoadLibraryExW 45409->45418 45410 7ff60acfa13d 45413 7ff60acfa1fe 45410->45413 45479 7ff60acf9ee0 45410->45479 45412 7ff60acfdcc0 LoadLibraryExW 45412->45418 45506 7ff60acdcd40 LoadLibraryExW 45413->45506 45418->45408 45418->45409 45418->45410 45418->45412 45419 7ff60acfa194 45418->45419 45426 7ff60acfa0f0 45418->45426 45443 7ff60acfa880 45418->45443 45503 7ff60acff360 LoadLibraryExW 45418->45503 45504 7ff60acdcd40 LoadLibraryExW 45418->45504 45511 7ff60ad089e0 LoadLibraryExW 45418->45511 45505 7ff60acdcd40 LoadLibraryExW 45419->45505 45421 7ff60acfa1a5 45421->45395 45424 7ff60acfa425 45425 7ff60acfa478 45424->45425 45493 7ff60ace7e20 45424->45493 45427 7ff60ad02ec0 LoadLibraryExW 45425->45427 45436 7ff60acfa3d6 45426->45436 45507 7ff60acf4560 LoadLibraryExW 45426->45507 45430 7ff60acfa494 45427->45430 45432 7ff60acfa4b5 45430->45432 45434 7ff60ad02ec0 LoadLibraryExW 45430->45434 45509 7ff60ad02f80 LoadLibraryExW 45432->45509 45433 7ff60ad02ec0 LoadLibraryExW 45433->45425 45434->45432 45487 7ff60acfa5a0 45436->45487 45437 7ff60acfa387 45437->45436 45508 7ff60acee6c0 LoadLibraryExW 45437->45508 45439 7ff60acfa4c5 45510 7ff60ad03060 LoadLibraryExW 45439->45510 45441 7ff60acfa534 45441->45395 45442->45391 45444 7ff60acfa88a 45443->45444 45444->45443 45452 7ff60acfa916 45444->45452 45512 7ff60acdd780 45444->45512 45447 7ff60ad02ec0 LoadLibraryExW 45451 7ff60acfaac9 45447->45451 45448 7ff60acfa8ff 45448->45452 45457 7ff60ad02ec0 LoadLibraryExW 45448->45457 45449 7ff60acfa9fc 45539 7ff60ad0a480 LoadLibraryExW 45449->45539 45546 7ff60ad02f80 LoadLibraryExW 45451->45546 45452->45447 45453 7ff60acfaa25 45540 7ff60ad0ad00 LoadLibraryExW 45453->45540 45456 7ff60acfaad5 45547 7ff60ad03060 LoadLibraryExW 45456->45547 45460 7ff60acfa966 45457->45460 45458 7ff60acfaa36 45541 7ff60ad0aa40 LoadLibraryExW 45458->45541 45537 7ff60ad02f80 LoadLibraryExW 45460->45537 45463 7ff60acfaaec 45528 7ff60acfc180 45463->45528 45464 7ff60acfa972 45538 7ff60ad03060 LoadLibraryExW 45464->45538 45465 7ff60acfaa45 45542 7ff60ad0ad00 LoadLibraryExW 45465->45542 45467 7ff60acfab05 45467->45418 45470 7ff60acfaa56 45543 7ff60ad0aa40 LoadLibraryExW 45470->45543 45471 7ff60acfa989 45473 7ff60acfc180 LoadLibraryExW 45471->45473 45473->45452 45474 7ff60acfaa68 45544 7ff60ad0ad00 LoadLibraryExW 45474->45544 45476 7ff60acfaa79 45545 7ff60ad0a4e0 LoadLibraryExW 45476->45545 45478 7ff60acfaa7e 45478->45418 45480 7ff60acf9eea 45479->45480 45480->45479 45481 7ff60acf9f1d 45480->45481 45485 7ff60acf9f05 45480->45485 45585 7ff60aceab60 45481->45585 45483 7ff60acf9f28 45483->45413 45484 7ff60acf9f49 45484->45413 45485->45484 45486 7ff60aceab60 LoadLibraryExW 45485->45486 45486->45485 45491 7ff60acfa5aa 45487->45491 45489 7ff60acfbb40 LoadLibraryExW 45489->45491 45490 7ff60acfa7ab 45490->45424 45491->45487 45491->45489 45491->45490 45492 7ff60ad07620 LoadLibraryExW 45491->45492 45613 7ff60acf9d80 LoadLibraryExW 45491->45613 45492->45491 45494 7ff60ace7e2a 45493->45494 45494->45493 45495 7ff60ace7e93 45494->45495 45496 7ff60ad06460 LoadLibraryExW 45494->45496 45497 7ff60ad0a480 LoadLibraryExW 45494->45497 45498 7ff60ad0aa40 LoadLibraryExW 45494->45498 45499 7ff60ad0ad00 LoadLibraryExW 45494->45499 45500 7ff60ad0a6c0 LoadLibraryExW 45494->45500 45501 7ff60ad0a4e0 LoadLibraryExW 45494->45501 45502 7ff60ad089e0 LoadLibraryExW 45494->45502 45495->45433 45496->45494 45497->45494 45498->45494 45499->45494 45500->45494 45501->45494 45502->45494 45503->45418 45504->45418 45505->45421 45506->45426 45507->45437 45508->45436 45509->45439 45510->45441 45511->45418 45519 7ff60acdd78f 45512->45519 45515 7ff60acddad9 45515->45448 45515->45449 45517 7ff60aceab60 LoadLibraryExW 45517->45519 45519->45512 45519->45515 45519->45517 45520 7ff60ad06460 LoadLibraryExW 45519->45520 45521 7ff60ad0ad00 LoadLibraryExW 45519->45521 45522 7ff60acdf3c0 LoadLibraryExW 45519->45522 45523 7ff60ad089e0 LoadLibraryExW 45519->45523 45524 7ff60acdf000 LoadLibraryExW 45519->45524 45525 7ff60ad0ab80 LoadLibraryExW 45519->45525 45548 7ff60ace8160 45519->45548 45555 7ff60ace8080 LoadLibraryExW 45519->45555 45556 7ff60acddf40 LoadLibraryExW 45519->45556 45557 7ff60ad0a480 LoadLibraryExW 45519->45557 45558 7ff60ad0a6c0 LoadLibraryExW 45519->45558 45559 7ff60ad0a4e0 LoadLibraryExW 45519->45559 45520->45519 45521->45519 45522->45519 45523->45519 45524->45519 45525->45519 45531 7ff60acfc18a 45528->45531 45531->45528 45534 7ff60acfc3ac 45531->45534 45535 7ff60ace7b60 LoadLibraryExW 45531->45535 45560 7ff60acfe5e0 45531->45560 45575 7ff60acf52c0 LoadLibraryExW 45531->45575 45576 7ff60ad01f40 LoadLibraryExW 45531->45576 45577 7ff60ad02320 LoadLibraryExW 45531->45577 45578 7ff60ad089e0 LoadLibraryExW 45531->45578 45534->45467 45535->45531 45537->45464 45538->45471 45539->45453 45540->45458 45541->45465 45542->45470 45543->45474 45544->45476 45545->45478 45546->45456 45547->45463 45549 7ff60ace816a 45548->45549 45549->45548 45550 7ff60ad06460 LoadLibraryExW 45549->45550 45551 7ff60ace81a5 45550->45551 45552 7ff60ace81c5 45551->45552 45553 7ff60ad06460 LoadLibraryExW 45551->45553 45552->45519 45554 7ff60ace8205 45553->45554 45554->45519 45555->45519 45556->45519 45557->45519 45558->45519 45559->45519 45565 7ff60acfe5ef 45560->45565 45562 7ff60acfe967 45580 7ff60acfeb80 LoadLibraryExW 45562->45580 45565->45560 45565->45562 45567 7ff60ad0ad00 LoadLibraryExW 45565->45567 45568 7ff60ad0ab80 LoadLibraryExW 45565->45568 45572 7ff60ad01fc0 LoadLibraryExW 45565->45572 45573 7ff60ad02ec0 LoadLibraryExW 45565->45573 45574 7ff60ace7e20 LoadLibraryExW 45565->45574 45579 7ff60ad01f40 LoadLibraryExW 45565->45579 45581 7ff60ad0a480 LoadLibraryExW 45565->45581 45582 7ff60ad0a6c0 LoadLibraryExW 45565->45582 45583 7ff60ad0a4e0 LoadLibraryExW 45565->45583 45584 7ff60ad089e0 LoadLibraryExW 45565->45584 45566 7ff60acfe995 45566->45531 45567->45565 45568->45565 45572->45565 45573->45565 45574->45565 45575->45531 45576->45531 45577->45531 45578->45531 45579->45565 45580->45566 45581->45565 45582->45565 45583->45565 45584->45565 45586 7ff60aceab6a 45585->45586 45586->45585 45587 7ff60aceab7e 45586->45587 45607 7ff60ad0a480 LoadLibraryExW 45586->45607 45608 7ff60ad0ad00 LoadLibraryExW 45586->45608 45609 7ff60ad0a4e0 LoadLibraryExW 45586->45609 45610 7ff60ad089e0 LoadLibraryExW 45586->45610 45589 7ff60aceab87 45587->45589 45590 7ff60aceabd7 45587->45590 45597 7ff60acdf000 45587->45597 45589->45483 45591 7ff60aceac07 45590->45591 45601 7ff60acf8f80 45590->45601 45591->45483 45599 7ff60acdf006 45597->45599 45598 7ff60ad36ec0 LoadLibraryExW 45600 7ff60acdf05c 45598->45600 45599->45597 45599->45598 45600->45590 45602 7ff60acf8f8a 45601->45602 45602->45601 45603 7ff60ace7b60 LoadLibraryExW 45602->45603 45604 7ff60acf90dc 45602->45604 45611 7ff60ace7c00 LoadLibraryExW 45602->45611 45612 7ff60ad089e0 LoadLibraryExW 45602->45612 45603->45602 45604->45591 45607->45586 45608->45586 45609->45586 45610->45586 45611->45602 45612->45602 45613->45491 45619 7ff60ad1034a 45614->45619 45615 7ff60ad10375 45615->45402 45618 7ff60ad10408 45654 7ff60acdcd40 LoadLibraryExW 45618->45654 45619->45614 45619->45615 45619->45618 45621 7ff60ad103c8 45619->45621 45651 7ff60acdcae0 LoadLibraryExW 45619->45651 45652 7ff60ad18dc0 LoadLibraryExW 45619->45652 45655 7ff60ad089e0 LoadLibraryExW 45619->45655 45653 7ff60acdcd40 LoadLibraryExW 45621->45653 45622 7ff60ad1041b 45630 7ff60ad0fd00 45622->45630 45626 7ff60ad103d6 45626->45402 45627 7ff60ad1042c 45627->45402 45628->45399 45629->45401 45647 7ff60ad0fd0a 45630->45647 45633 7ff60ad0fe0c 45672 7ff60ad0c520 LoadLibraryExW 45633->45672 45635 7ff60ad0fe11 45673 7ff60acdcd40 LoadLibraryExW 45635->45673 45636 7ff60ad0fea4 45638 7ff60ad0febb 45636->45638 45675 7ff60acdcd40 LoadLibraryExW 45636->45675 45638->45627 45640 7ff60ad0fe05 45676 7ff60acdce40 LoadLibraryExW 45640->45676 45642 7ff60ad089e0 LoadLibraryExW 45642->45647 45643 7ff60ad0fe31 45656 7ff60ad0f760 45643->45656 45646 7ff60ad0fe58 45649 7ff60ad0fe72 45646->45649 45674 7ff60acdcae0 LoadLibraryExW 45646->45674 45647->45630 45647->45633 45647->45636 45647->45640 45647->45642 45669 7ff60acdcae0 LoadLibraryExW 45647->45669 45670 7ff60ad18c20 LoadLibraryExW 45647->45670 45671 7ff60acdcd40 LoadLibraryExW 45647->45671 45648 7ff60ad0ff09 45648->45627 45649->45627 45651->45619 45652->45619 45653->45626 45654->45622 45655->45619 45662 7ff60ad0f76a 45656->45662 45658 7ff60ad0f867 45700 7ff60ad0f8e0 45658->45700 45660 7ff60ad0f86c 45660->45646 45662->45656 45662->45658 45663 7ff60ad0f7f2 45662->45663 45677 7ff60ad0ec80 45662->45677 45717 7ff60acdcae0 LoadLibraryExW 45662->45717 45720 7ff60ad089e0 LoadLibraryExW 45662->45720 45665 7ff60ad0f829 45663->45665 45718 7ff60acdce40 LoadLibraryExW 45663->45718 45719 7ff60acdcd40 LoadLibraryExW 45665->45719 45668 7ff60ad0f837 45668->45646 45669->45647 45670->45647 45671->45647 45672->45635 45673->45643 45674->45649 45675->45638 45676->45648 45679 7ff60ad0ec8a 45677->45679 45679->45677 45725 7ff60ad1b000 LoadLibraryExW 45679->45725 45680 7ff60ad0ecad 45681 7ff60ad0ecda 45680->45681 45726 7ff60ad16b60 LoadLibraryExW 45680->45726 45690 7ff60ad0ed05 45681->45690 45727 7ff60acdcae0 LoadLibraryExW 45681->45727 45685 7ff60ad0eef2 45738 7ff60acdcd40 LoadLibraryExW 45685->45738 45686 7ff60ad0ed11 45728 7ff60ad0c580 LoadLibraryExW 45686->45728 45689 7ff60ad0ed45 45729 7ff60ad14b20 LoadLibraryExW 45689->45729 45721 7ff60acded40 45690->45721 45693 7ff60ad0ecf2 45693->45685 45694 7ff60ad36ec0 LoadLibraryExW 45693->45694 45737 7ff60ad29d80 LoadLibraryExW 45693->45737 45694->45693 45695 7ff60ad0ed4f 45696 7ff60ad0edb5 45695->45696 45730 7ff60ad16dc0 45695->45730 45736 7ff60ad1b120 LoadLibraryExW 45696->45736 45699 7ff60ad0edf6 45699->45662 45701 7ff60ad0f8ea 45700->45701 45701->45700 45702 7ff60ad0f983 45701->45702 45703 7ff60ad0f91c 45701->45703 45768 7ff60ad089e0 LoadLibraryExW 45701->45768 45765 7ff60ad1b000 LoadLibraryExW 45702->45765 45763 7ff60ad1b000 LoadLibraryExW 45703->45763 45705 7ff60ad0f994 45766 7ff60ad05ae0 LoadLibraryExW 45705->45766 45709 7ff60ad0f945 45711 7ff60ad38ac0 LoadLibraryExW 45709->45711 45710 7ff60ad0f99e 45767 7ff60ad1b120 LoadLibraryExW 45710->45767 45713 7ff60ad0f95f 45711->45713 45764 7ff60ad1b120 LoadLibraryExW 45713->45764 45714 7ff60ad0f9aa 45714->45660 45716 7ff60ad0f97d 45716->45660 45717->45662 45718->45665 45719->45668 45720->45662 45722 7ff60acded46 45721->45722 45722->45721 45739 7ff60acde320 45722->45739 45724 7ff60acded65 45724->45686 45725->45680 45726->45681 45727->45693 45728->45689 45729->45695 45731 7ff60ad16dca 45730->45731 45731->45730 45732 7ff60ad16e05 45731->45732 45761 7ff60ad288a0 LoadLibraryExW 45731->45761 45762 7ff60ad16e60 LoadLibraryExW 45732->45762 45735 7ff60ad16e45 45735->45696 45736->45699 45737->45693 45738->45690 45752 7ff60acde32a 45739->45752 45740 7ff60ad089e0 LoadLibraryExW 45740->45752 45741 7ff60acdec20 LoadLibraryExW 45741->45752 45742 7ff60acde36b 45743 7ff60acdf000 LoadLibraryExW 45742->45743 45744 7ff60acde3b9 45743->45744 45744->45724 45745 7ff60ace6ce0 LoadLibraryExW 45745->45752 45746 7ff60acde4f6 45746->45724 45747 7ff60ace6720 LoadLibraryExW 45747->45752 45748 7ff60acf2020 LoadLibraryExW 45748->45752 45749 7ff60acde120 LoadLibraryExW 45749->45752 45750 7ff60acdee20 LoadLibraryExW 45750->45752 45751 7ff60acdea98 45753 7ff60acdeac6 45751->45753 45755 7ff60ad01a80 LoadLibraryExW 45751->45755 45752->45739 45752->45740 45752->45741 45752->45742 45752->45745 45752->45746 45752->45747 45752->45748 45752->45749 45752->45750 45752->45751 45754 7ff60acdea89 45752->45754 45756 7ff60acdeb34 45753->45756 45758 7ff60aceb180 LoadLibraryExW 45753->45758 45757 7ff60acdeca0 LoadLibraryExW 45754->45757 45755->45753 45756->45724 45757->45751 45759 7ff60acdeb25 45758->45759 45759->45756 45760 7ff60aceb280 LoadLibraryExW 45759->45760 45760->45756 45761->45732 45762->45735 45763->45709 45764->45716 45765->45705 45766->45710 45767->45714 45768->45701 45769 7ff60ad36e40 45770 7ff60ad36e6f 45769->45770 45771 7ff60ad36e74 45769->45771 45792 7ff60ad0bde0 LoadLibraryExW 45770->45792 45778 7ff60ad12c80 45771->45778 45779 7ff60ad12c8a 45778->45779 45779->45778 45818 7ff60ad0d360 LoadLibraryExW 45779->45818 45781 7ff60ad12cd8 45786 7ff60ad12d05 45781->45786 45819 7ff60ad29400 LoadLibraryExW 45781->45819 45783 7ff60ad12e67 45804 7ff60ad127e0 45783->45804 45786->45783 45820 7ff60ad0d360 LoadLibraryExW 45786->45820 45788 7ff60ad12dfd 45789 7ff60ad12e1b 45788->45789 45821 7ff60ad29540 LoadLibraryExW 45788->45821 45794 7ff60ad108a0 45789->45794 45793 7ff60ad0be20 LoadLibraryExW 45795 7ff60ad108aa 45794->45795 45795->45794 45798 7ff60ad108d9 45795->45798 45822 7ff60ad016a0 LoadLibraryExW 45795->45822 45823 7ff60ad0d360 LoadLibraryExW 45798->45823 45799 7ff60ad1093b 45801 7ff60ad10993 45799->45801 45824 7ff60ad06820 LoadLibraryExW 45799->45824 45802 7ff60ad109c5 45801->45802 45825 7ff60ad29100 LoadLibraryExW 45801->45825 45802->45783 45806 7ff60ad127ea 45804->45806 45806->45804 45807 7ff60ad108a0 LoadLibraryExW 45806->45807 45808 7ff60ad089e0 LoadLibraryExW 45806->45808 45811 7ff60acdcae0 LoadLibraryExW 45806->45811 45812 7ff60ad12a17 45806->45812 45813 7ff60ad10340 LoadLibraryExW 45806->45813 45817 7ff60acdcd40 LoadLibraryExW 45806->45817 45826 7ff60ad10480 45806->45826 45842 7ff60ad12420 45806->45842 45848 7ff60ad10700 LoadLibraryExW 45806->45848 45849 7ff60ad10a60 LoadLibraryExW 45806->45849 45807->45806 45808->45806 45811->45806 45814 7ff60ad108a0 LoadLibraryExW 45812->45814 45813->45806 45816 7ff60ad12a1c 45814->45816 45816->45793 45817->45806 45818->45781 45819->45786 45820->45788 45821->45789 45822->45798 45823->45799 45824->45801 45825->45802 45829 7ff60ad1048a 45826->45829 45827 7ff60ad16dc0 LoadLibraryExW 45827->45829 45829->45826 45829->45827 45832 7ff60ad1052a 45829->45832 45833 7ff60ad0a480 LoadLibraryExW 45829->45833 45836 7ff60ad0a4e0 LoadLibraryExW 45829->45836 45837 7ff60ad0ac80 LoadLibraryExW 45829->45837 45838 7ff60ad0aa40 LoadLibraryExW 45829->45838 45839 7ff60ad0a6c0 LoadLibraryExW 45829->45839 45840 7ff60ad0ad00 LoadLibraryExW 45829->45840 45841 7ff60ad089e0 LoadLibraryExW 45829->45841 45850 7ff60ad0ffe0 45829->45850 45896 7ff60ad16fa0 LoadLibraryExW 45829->45896 45897 7ff60acdcec0 LoadLibraryExW 45829->45897 45898 7ff60ad16b60 LoadLibraryExW 45832->45898 45833->45829 45835 7ff60ad1053a 45835->45806 45836->45829 45837->45829 45838->45829 45839->45829 45840->45829 45841->45829 45843 7ff60ad12426 45842->45843 45843->45842 45844 7ff60ad12459 45843->45844 45845 7ff60ad089e0 LoadLibraryExW 45843->45845 45846 7ff60ad10340 LoadLibraryExW 45844->45846 45845->45843 45847 7ff60ad1245e 45846->45847 45847->45806 45848->45806 45849->45806 45852 7ff60ad0ffea 45850->45852 45851 7ff60ad1030d 45853 7ff60ad0fd00 LoadLibraryExW 45851->45853 45852->45850 45852->45851 45860 7ff60ad10036 45852->45860 45854 7ff60ad10316 45853->45854 45854->45829 45855 7ff60ad10122 45856 7ff60ad10176 45855->45856 45857 7ff60ad10155 45855->45857 45899 7ff60acdcae0 LoadLibraryExW 45856->45899 45861 7ff60ad0fd00 LoadLibraryExW 45857->45861 45858 7ff60ad100b4 45858->45855 45863 7ff60ad10113 45858->45863 45860->45858 45864 7ff60ad100a5 45860->45864 45865 7ff60ad10170 45861->45865 45862 7ff60ad10185 45866 7ff60ad1018f 45862->45866 45881 7ff60ad101cf 45862->45881 45867 7ff60ad0fd00 LoadLibraryExW 45863->45867 45868 7ff60ad0fd00 LoadLibraryExW 45864->45868 45865->45829 45869 7ff60ad101bb 45866->45869 45900 7ff60acdce40 LoadLibraryExW 45866->45900 45870 7ff60ad1011c 45867->45870 45871 7ff60ad100ae 45868->45871 45901 7ff60acdcd40 LoadLibraryExW 45869->45901 45870->45829 45871->45829 45874 7ff60ad101c9 45874->45829 45875 7ff60ad10231 45876 7ff60ad10246 45875->45876 45877 7ff60ad102eb 45875->45877 45879 7ff60ad1028b 45876->45879 45882 7ff60ad10265 45876->45882 45907 7ff60acdcd40 LoadLibraryExW 45877->45907 45904 7ff60ad18a80 LoadLibraryExW 45879->45904 45880 7ff60ad102f9 45883 7ff60ad0fd00 LoadLibraryExW 45880->45883 45881->45875 45902 7ff60acdce40 LoadLibraryExW 45881->45902 45903 7ff60acdcd40 LoadLibraryExW 45882->45903 45888 7ff60ad10307 45883->45888 45887 7ff60ad10273 45890 7ff60ad0fd00 LoadLibraryExW 45887->45890 45888->45829 45889 7ff60ad102c5 45905 7ff60acdcd40 LoadLibraryExW 45889->45905 45892 7ff60ad10285 45890->45892 45892->45829 45893 7ff60ad102d3 45894 7ff60ad102e5 45893->45894 45906 7ff60ad123c0 LoadLibraryExW 45893->45906 45894->45829 45896->45829 45897->45829 45898->45835 45899->45862 45900->45869 45901->45874 45902->45875 45903->45887 45904->45889 45905->45893 45906->45894 45907->45880 45908 7ff60ad0e380 45909 7ff60ad0e393 45908->45909 45914 7ff60ad0e400 45909->45914 45913 7ff60ad0e3f4 45916 7ff60ad0e40a 45914->45916 45915 7ff60ad0e429 45929 7ff60ad05c80 45915->45929 45916->45914 45916->45915 45964 7ff60ad089e0 LoadLibraryExW 45916->45964 45919 7ff60ad0e465 45920 7ff60ad0e47c 45919->45920 45962 7ff60ad0e500 LoadLibraryExW 45919->45962 45921 7ff60ad0e49d 45920->45921 45945 7ff60ad17440 45920->45945 45923 7ff60ad0e4be 45921->45923 45963 7ff60ad16b60 LoadLibraryExW 45921->45963 45925 7ff60ad127e0 LoadLibraryExW 45923->45925 45926 7ff60ad0e3ea 45925->45926 45928 7ff60ad0e540 LoadLibraryExW 45926->45928 45928->45913 45936 7ff60ad05c8f 45929->45936 45930 7ff60ad065e0 LoadLibraryExW 45930->45936 45932 7ff60ad06200 LoadLibraryExW 45932->45936 45934 7ff60ad0aa40 LoadLibraryExW 45934->45936 45935 7ff60ad06460 LoadLibraryExW 45935->45936 45936->45929 45936->45930 45936->45932 45936->45934 45936->45935 45937 7ff60ad063e0 LoadLibraryExW 45936->45937 45938 7ff60ad0a4e0 LoadLibraryExW 45936->45938 45939 7ff60ad05e6c 45936->45939 45940 7ff60ad0a480 LoadLibraryExW 45936->45940 45941 7ff60ad0ad00 LoadLibraryExW 45936->45941 45942 7ff60ad0a6c0 LoadLibraryExW 45936->45942 45943 7ff60ad0ab80 LoadLibraryExW 45936->45943 45944 7ff60ad089e0 LoadLibraryExW 45936->45944 45965 7ff60acdcae0 LoadLibraryExW 45936->45965 45966 7ff60acdcd40 LoadLibraryExW 45936->45966 45937->45936 45938->45936 45939->45919 45940->45936 45941->45936 45942->45936 45943->45936 45944->45936 45954 7ff60ad1744a 45945->45954 45947 7ff60ad36ec0 LoadLibraryExW 45947->45954 45949 7ff60ad38ac0 LoadLibraryExW 45949->45954 45950 7ff60acdcd40 LoadLibraryExW 45950->45954 45954->45945 45954->45947 45954->45949 45954->45950 45957 7ff60ad16fa0 LoadLibraryExW 45954->45957 45958 7ff60ad124a0 LoadLibraryExW 45954->45958 45959 7ff60ad04920 LoadLibraryExW 45954->45959 45960 7ff60acdcae0 LoadLibraryExW 45954->45960 45967 7ff60ad17000 LoadLibraryExW 45954->45967 45968 7ff60ad26f60 LoadLibraryExW 45954->45968 45969 7ff60acdd280 LoadLibraryExW 45954->45969 45970 7ff60ad03dc0 LoadLibraryExW 45954->45970 45971 7ff60acf3fa0 LoadLibraryExW 45954->45971 45972 7ff60ad179e0 LoadLibraryExW 45954->45972 45973 7ff60aceb180 LoadLibraryExW 45954->45973 45974 7ff60ad17de0 LoadLibraryExW 45954->45974 45957->45954 45958->45954 45959->45954 45960->45954 45962->45920 45963->45923 45964->45916 45965->45936 45966->45936 45967->45954 45968->45954 45969->45954 45970->45954 45971->45954 45972->45954 45973->45954 45974->45954 45975 7ff60ad17900 45976 7ff60ad1790a 45975->45976 45976->45975 45977 7ff60ad17967 45976->45977 45981 7ff60ad06560 45976->45981 45978 7ff60ad06360 LoadLibraryExW 45977->45978 45980 7ff60ad179ba 45978->45980 45982 7ff60ad06200 LoadLibraryExW 45981->45982 45983 7ff60ad065b6 45982->45983 45983->45977 45984 7ff60ad0c1c0 46003 7ff60ad0c1ca 45984->46003 46003->45984 46004 7ff60ad0c3c9 46003->46004 46008 7ff60acdd400 46003->46008 46023 7ff60acd1fa0 46003->46023 46029 7ff60ad04ee0 46003->46029 46044 7ff60ad1a860 46003->46044 46060 7ff60ad19fe0 LoadLibraryExW 46003->46060 46061 7ff60ad22d00 LoadLibraryExW 46003->46061 46062 7ff60ad19ae0 LoadLibraryExW 46003->46062 46063 7ff60acd5640 LoadLibraryExW 46003->46063 46064 7ff60ad0c580 LoadLibraryExW 46003->46064 46065 7ff60ad22ae0 LoadLibraryExW 46003->46065 46066 7ff60ad2f100 LoadLibraryExW 46003->46066 46067 7ff60acdb8e0 LoadLibraryExW 46003->46067 46068 7ff60ad20e80 LoadLibraryExW 46003->46068 46069 7ff60aceaca0 LoadLibraryExW 46003->46069 46070 7ff60ad1e320 46003->46070 46079 7ff60acdcae0 LoadLibraryExW 46003->46079 46080 7ff60acd8b20 LoadLibraryExW 46003->46080 46081 7ff60ad161c0 LoadLibraryExW 46003->46081 46083 7ff60ad089e0 LoadLibraryExW 46003->46083 46082 7ff60acdcd40 LoadLibraryExW 46004->46082 46007 7ff60ad0c3d7 46017 7ff60acdd40a 46008->46017 46009 7ff60ad0a480 LoadLibraryExW 46009->46017 46010 7ff60ad0aa40 LoadLibraryExW 46010->46017 46011 7ff60acdd4cb 46084 7ff60acf91e0 46011->46084 46013 7ff60ad0ab20 LoadLibraryExW 46013->46017 46016 7ff60ad0ad00 LoadLibraryExW 46016->46017 46017->46008 46017->46009 46017->46010 46017->46011 46017->46013 46017->46016 46018 7ff60ad0a4e0 LoadLibraryExW 46017->46018 46019 7ff60ad089e0 LoadLibraryExW 46017->46019 46018->46017 46019->46017 46020 7ff60acdd562 46020->46003 46021 7ff60acdd4dc 46021->46020 46022 7ff60aceab60 LoadLibraryExW 46021->46022 46022->46021 46024 7ff60acd1fa6 46023->46024 46024->46023 46144 7ff60acd2540 46024->46144 46026 7ff60acd1fbd 46154 7ff60acd2000 LoadLibraryExW 46026->46154 46028 7ff60acd1fcc 46028->46003 46041 7ff60ad04eea 46029->46041 46030 7ff60ad06200 LoadLibraryExW 46030->46041 46032 7ff60ad0503c 46033 7ff60ad062e0 LoadLibraryExW 46032->46033 46035 7ff60ad05051 46033->46035 46172 7ff60ad35040 LoadLibraryExW 46035->46172 46037 7ff60ad0508f 46038 7ff60ad06360 LoadLibraryExW 46037->46038 46039 7ff60ad050ad 46038->46039 46158 7ff60ad046e0 46039->46158 46041->46029 46041->46030 46041->46032 46043 7ff60ad050eb 46041->46043 46170 7ff60ad1d420 LoadLibraryExW 46041->46170 46171 7ff60ad21f80 LoadLibraryExW 46041->46171 46042 7ff60ad050c5 46042->46003 46043->46003 46045 7ff60ad1a86a 46044->46045 46045->46044 46175 7ff60acd8b20 LoadLibraryExW 46045->46175 46047 7ff60ad1a8ab 46048 7ff60acded40 LoadLibraryExW 46047->46048 46049 7ff60ad1a8c5 46048->46049 46176 7ff60ad32a40 LoadLibraryExW 46049->46176 46051 7ff60ad1a905 46177 7ff60ad1ab60 LoadLibraryExW 46051->46177 46053 7ff60ad1a95e 46178 7ff60ad1ab60 LoadLibraryExW 46053->46178 46055 7ff60ad1a96f 46179 7ff60acd8b20 LoadLibraryExW 46055->46179 46057 7ff60ad1a99b 46180 7ff60ad34400 LoadLibraryExW 46057->46180 46059 7ff60ad1a9a5 46059->46003 46060->46003 46061->46003 46062->46003 46063->46003 46064->46003 46065->46003 46066->46003 46067->46003 46068->46003 46069->46003 46077 7ff60ad1e32a 46070->46077 46071 7ff60ace7b60 LoadLibraryExW 46071->46077 46072 7ff60acdcae0 LoadLibraryExW 46072->46077 46074 7ff60acdcd40 LoadLibraryExW 46074->46077 46075 7ff60ad1e3b1 46075->46003 46077->46070 46077->46071 46077->46072 46077->46074 46077->46075 46078 7ff60ad089e0 LoadLibraryExW 46077->46078 46181 7ff60acf9c40 46077->46181 46187 7ff60acfafc0 LoadLibraryExW 46077->46187 46078->46077 46079->46003 46080->46003 46081->46003 46082->46007 46083->46003 46085 7ff60acf91ea 46084->46085 46085->46084 46118 7ff60aceaa40 LoadLibraryExW 46085->46118 46087 7ff60acf921e 46119 7ff60aceaa40 LoadLibraryExW 46087->46119 46089 7ff60acf9245 46120 7ff60aceaa40 LoadLibraryExW 46089->46120 46091 7ff60acf9269 46121 7ff60aceaa40 LoadLibraryExW 46091->46121 46093 7ff60acf928d 46122 7ff60aceaa40 LoadLibraryExW 46093->46122 46095 7ff60acf92b1 46123 7ff60aceaa40 LoadLibraryExW 46095->46123 46097 7ff60acf92d5 46124 7ff60aceaa40 LoadLibraryExW 46097->46124 46099 7ff60acf92f9 46103 7ff60acfbfc0 46099->46103 46102 7ff60ace6940 LoadLibraryExW 46102->46021 46104 7ff60acfbfca 46103->46104 46104->46103 46105 7ff60acfbfea 46104->46105 46106 7ff60ad0a480 LoadLibraryExW 46104->46106 46108 7ff60ad0ad00 LoadLibraryExW 46104->46108 46114 7ff60ad0ab20 LoadLibraryExW 46104->46114 46115 7ff60ad0a6c0 LoadLibraryExW 46104->46115 46116 7ff60ad0a4e0 LoadLibraryExW 46104->46116 46138 7ff60ad089e0 LoadLibraryExW 46104->46138 46125 7ff60ad020a0 46105->46125 46106->46104 46108->46104 46109 7ff60acfc036 46129 7ff60acfe4a0 46109->46129 46111 7ff60acfc045 46134 7ff60acf51e0 46111->46134 46114->46104 46115->46104 46116->46104 46118->46087 46119->46089 46120->46091 46121->46093 46122->46095 46123->46097 46124->46099 46126 7ff60ad020a6 46125->46126 46126->46125 46127 7ff60acdf000 LoadLibraryExW 46126->46127 46128 7ff60ad020da 46127->46128 46128->46109 46132 7ff60acfe4aa 46129->46132 46130 7ff60acfe5a5 46130->46111 46131 7ff60ace8160 LoadLibraryExW 46131->46132 46132->46129 46132->46130 46132->46131 46139 7ff60ad089e0 LoadLibraryExW 46132->46139 46135 7ff60acf51ea 46134->46135 46135->46134 46140 7ff60acfee80 46135->46140 46137 7ff60acdd4d7 46137->46102 46138->46104 46139->46132 46141 7ff60acfee86 46140->46141 46141->46140 46142 7ff60ace8160 LoadLibraryExW 46141->46142 46143 7ff60acfeea5 46142->46143 46143->46137 46145 7ff60acd254a 46144->46145 46145->46144 46146 7ff60acded40 LoadLibraryExW 46145->46146 46147 7ff60acd255e 46146->46147 46149 7ff60acd26bb 46147->46149 46155 7ff60ad1d500 LoadLibraryExW 46147->46155 46152 7ff60acd28cd 46149->46152 46156 7ff60ad1d500 LoadLibraryExW 46149->46156 46153 7ff60acd2ada 46152->46153 46157 7ff60ad1d500 LoadLibraryExW 46152->46157 46153->46026 46154->46028 46155->46149 46156->46152 46157->46153 46159 7ff60ad046ea 46158->46159 46159->46158 46160 7ff60ad063e0 LoadLibraryExW 46159->46160 46161 7ff60ad04725 46160->46161 46162 7ff60ad047fa 46161->46162 46173 7ff60ad04220 LoadLibraryExW 46161->46173 46162->46042 46164 7ff60ad047f4 46164->46042 46165 7ff60ad0475d 46165->46164 46174 7ff60ad35040 LoadLibraryExW 46165->46174 46167 7ff60ad0479a 46168 7ff60ad063e0 LoadLibraryExW 46167->46168 46169 7ff60ad047dc 46168->46169 46169->46042 46170->46041 46171->46041 46172->46037 46173->46165 46174->46167 46175->46047 46176->46051 46177->46053 46178->46055 46179->46057 46180->46059 46183 7ff60acf9c46 46181->46183 46182 7ff60acf9c52 46184 7ff60acf9fe0 LoadLibraryExW 46182->46184 46183->46181 46183->46182 46188 7ff60ad089e0 LoadLibraryExW 46183->46188 46186 7ff60acf9c59 46184->46186 46186->46077 46187->46077 46188->46183 46189 7ff60ad1f440 46196 7ff60ad1f452 46189->46196 46190 7ff60ad089e0 LoadLibraryExW 46190->46196 46191 7ff60ad0a480 LoadLibraryExW 46191->46196 46193 7ff60ad1f7c6 46195 7ff60ad1f7db 46193->46195 46251 7ff60ad20100 LoadLibraryExW 46193->46251 46194 7ff60ad1f811 46198 7ff60ad1f84f 46194->46198 46254 7ff60ad24380 LoadLibraryExW 46194->46254 46206 7ff60ad1f7fe 46195->46206 46252 7ff60ad132a0 LoadLibraryExW 46195->46252 46196->46189 46196->46190 46196->46191 46196->46193 46196->46194 46208 7ff60ad0ac80 LoadLibraryExW 46196->46208 46224 7ff60ad0ab80 LoadLibraryExW 46196->46224 46226 7ff60ad0a6c0 LoadLibraryExW 46196->46226 46229 7ff60ad0ad00 LoadLibraryExW 46196->46229 46232 7ff60ad0a4e0 LoadLibraryExW 46196->46232 46233 7ff60ad2c300 LoadLibraryExW 46196->46233 46264 7ff60ad0aa40 LoadLibraryExW 46196->46264 46265 7ff60ad23540 LoadLibraryExW 46196->46265 46199 7ff60ad1f922 46198->46199 46202 7ff60ad1f8ad 46198->46202 46230 7ff60ad1f96a 46199->46230 46257 7ff60ad0a480 LoadLibraryExW 46199->46257 46255 7ff60ad0d360 LoadLibraryExW 46202->46255 46253 7ff60ad12ea0 LoadLibraryExW 46206->46253 46207 7ff60ad1f934 46258 7ff60ad0ad00 LoadLibraryExW 46207->46258 46208->46196 46209 7ff60ad1f8c9 46234 7ff60ad1f000 46209->46234 46213 7ff60ad1f945 46259 7ff60ad0aa40 LoadLibraryExW 46213->46259 46218 7ff60ad1f8f2 46219 7ff60ad1f951 46260 7ff60ad0ad00 LoadLibraryExW 46219->46260 46221 7ff60ad1f965 46261 7ff60ad0a4e0 LoadLibraryExW 46221->46261 46222 7ff60ad0a4e0 LoadLibraryExW 46222->46230 46224->46196 46225 7ff60ad0a480 LoadLibraryExW 46225->46230 46226->46196 46227 7ff60ad0ab80 LoadLibraryExW 46227->46230 46228 7ff60ad0ad00 LoadLibraryExW 46228->46230 46229->46196 46230->46222 46230->46225 46230->46227 46230->46228 46262 7ff60ad089e0 LoadLibraryExW 46230->46262 46263 7ff60ad0aa40 LoadLibraryExW 46230->46263 46232->46196 46233->46196 46235 7ff60ad1f00f 46234->46235 46235->46234 46236 7ff60ad1f032 46235->46236 46237 7ff60ad089e0 LoadLibraryExW 46235->46237 46238 7ff60ad1e320 LoadLibraryExW 46236->46238 46237->46235 46239 7ff60ad1f0e5 46238->46239 46241 7ff60ad1f15a 46239->46241 46243 7ff60ad1f18d 46239->46243 46270 7ff60ad089e0 LoadLibraryExW 46239->46270 46271 7ff60ad1eea0 LoadLibraryExW 46241->46271 46266 7ff60ad2a8c0 LoadLibraryExW 46243->46266 46246 7ff60ad1f2d6 46248 7ff60ad1f2fc 46246->46248 46267 7ff60ad1eb00 LoadLibraryExW 46246->46267 46268 7ff60ad2af00 LoadLibraryExW 46246->46268 46269 7ff60ad1e600 LoadLibraryExW 46248->46269 46250 7ff60ad1f331 46256 7ff60ad0d360 LoadLibraryExW 46250->46256 46251->46195 46252->46206 46253->46194 46254->46198 46255->46209 46256->46218 46257->46207 46258->46213 46259->46219 46260->46221 46261->46230 46262->46230 46263->46230 46264->46196 46265->46196 46266->46246 46267->46246 46268->46246 46269->46250 46270->46241 46271->46243

                                    Executed Functions

                                    Function 00007FF60ACDD780 Relevance: 14.1, Strings: 11, Instructions: 384COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 350 7ff60acdd780-7ff60acdd789 351 7ff60acdd78f-7ff60acdd7d2 350->351 352 7ff60acddf06-7ff60acddf33 call 7ff60ad36fe0 350->352 353 7ff60acdd7d4-7ff60acdd7d6 351->353 354 7ff60acdd7db-7ff60acdd7f9 call 7ff60acdf3c0 351->354 352->350 356 7ff60acddba7-7ff60acddbad 353->356 364 7ff60acdd825 354->364 365 7ff60acdd7fb-7ff60acdd820 354->365 359 7ff60acddbb3-7ff60acddbd4 356->359 360 7ff60acddcd2-7ff60acddce1 356->360 362 7ff60acddbe5-7ff60acddc07 359->362 363 7ff60acddbd6-7ff60acddbe3 359->363 366 7ff60acddce4-7ff60acddce7 360->366 370 7ff60acddc0e-7ff60acddc20 call 7ff60ace8160 362->370 371 7ff60acddc09-7ff60acddc0c 362->371 369 7ff60acddc61-7ff60acddc67 363->369 372 7ff60acdd82a-7ff60acdd8a3 364->372 365->356 367 7ff60acdddab-7ff60acdddb5 366->367 368 7ff60acddced-7ff60acddd03 call 7ff60acddf40 366->368 375 7ff60acdddd0-7ff60acddde9 367->375 376 7ff60acdddb7-7ff60acdddce 367->376 391 7ff60acdde45-7ff60acdde51 368->391 392 7ff60acddd09-7ff60acddda1 call 7ff60aceab60 * 2 368->392 377 7ff60acddcbe-7ff60acddcd0 369->377 378 7ff60acddc69-7ff60acddc6c 369->378 381 7ff60acddc25-7ff60acddc59 370->381 371->369 387 7ff60acddb05-7ff60acddb10 372->387 388 7ff60acdd8a9-7ff60acdd8b4 372->388 385 7ff60acdddeb-7ff60acdddf8 375->385 386 7ff60acdddfa-7ff60acdde26 375->386 382 7ff60acdde2a-7ff60acdde2d 376->382 377->366 383 7ff60acddc72-7ff60acddcb9 call 7ff60ace8080 378->383 384 7ff60acddb76-7ff60acddba4 378->384 381->369 394 7ff60acdde65-7ff60acddf05 call 7ff60ad0a480 call 7ff60ad0ad00 call 7ff60ad0ab80 call 7ff60ad0ad00 call 7ff60ad0ab80 call 7ff60ad0ad00 * 2 call 7ff60ad0a6c0 call 7ff60ad0a4e0 call 7ff60ad089e0 382->394 395 7ff60acdde2f-7ff60acdde36 382->395 383->384 384->356 385->382 386->382 389 7ff60acdd8ba-7ff60acdd8ca 388->389 390 7ff60acddb69-7ff60acddb71 call 7ff60ad39300 388->390 396 7ff60acdd8d0-7ff60acdd905 call 7ff60ad06460 389->396 397 7ff60acdd977-7ff60acdd988 389->397 390->384 392->367 394->352 402 7ff60acdde52-7ff60acdde60 call 7ff60ad089e0 395->402 403 7ff60acdde38-7ff60acdde40 395->403 410 7ff60acdd90a-7ff60acdd924 396->410 408 7ff60acdd98e-7ff60acdd9bb call 7ff60acdf3c0 397->408 409 7ff60acddb47-7ff60acddb53 call 7ff60ad089e0 397->409 402->394 403->372 424 7ff60acdd9bd-7ff60acdd9d6 call 7ff60acdf000 408->424 425 7ff60acdd9dc-7ff60acdd9e7 408->425 416 7ff60acddb58-7ff60acddb64 call 7ff60ad089e0 409->416 415 7ff60acdd92a-7ff60acdd939 410->415 410->416 420 7ff60acdd93e 415->420 421 7ff60acdd93b-7ff60acdd93c 415->421 416->390 428 7ff60acdd93f-7ff60acdd96d 420->428 421->428 424->425 440 7ff60acddb36-7ff60acddb42 call 7ff60ad089e0 424->440 426 7ff60acddaee-7ff60acddafb 425->426 427 7ff60acdd9ed-7ff60acdda07 425->427 426->387 431 7ff60acdda0d-7ff60acdda19 427->431 432 7ff60acddab6-7ff60acddacb 427->432 428->397 435 7ff60acdda22-7ff60acdda43 call 7ff60acdf000 431->435 436 7ff60acdda1b 431->436 438 7ff60acddacd-7ff60acddad7 432->438 439 7ff60acddb1c-7ff60acddb20 call 7ff60ad39360 432->439 449 7ff60acddb25-7ff60acddb31 call 7ff60ad089e0 435->449 451 7ff60acdda49-7ff60acdda8e 435->451 436->435 445 7ff60acddb11-7ff60acddb17 call 7ff60ad392e0 438->445 446 7ff60acddad9-7ff60acddae9 438->446 439->449 440->409 445->439 449->440 454 7ff60acddaa1-7ff60acddaae 451->454 455 7ff60acdda90-7ff60acdda99 call 7ff60ad39c60 451->455 454->432 455->454
                                    Strings
                                    • arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p , xrefs: 00007FF60ACDDB47
                                    • base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c, xrefs: 00007FF60ACDDDF1
                                    • out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume, xrefs: 00007FF60ACDDB58
                                    • ) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: , xrefs: 00007FF60ACDDEC5
                                    • , : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+, xrefs: 00007FF60ACDDEA5
                                    • memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new , xrefs: 00007FF60ACDDEF2
                                    • , xrefs: 00007FF60ACDDE0F
                                    • region exceeds uintptr rangeneed padding in bucket (key)/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime., xrefs: 00007FF60ACDDDC7
                                    • out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi, xrefs: 00007FF60ACDDB36
                                    • end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo, xrefs: 00007FF60ACDDE1F
                                    • out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit, xrefs: 00007FF60ACDDB25
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: $) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: $, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+$arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p $base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c$end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo$memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new $out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit$out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume$out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi$region exceeds uintptr rangeneed padding in bucket (key)/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.
                                    • API String ID: 0-936411634
                                    • Opcode ID: 03971cda208206f7927824e227f210f5584e0e69b1411dfe24f4519c567dcd32
                                    • Instruction ID: adce6d76d15fd4395626be7930f7125272e58b2d24d8920d0b16fdf0888e6494
                                    • Opcode Fuzzy Hash: 03971cda208206f7927824e227f210f5584e0e69b1411dfe24f4519c567dcd32
                                    • Instruction Fuzzy Hash: CA02AC33A09B8191EA609B11E4407BAB7A4FB85BD0F6582B5EE9E937D5CF3CE444C740
                                    Function 00007FF60ACDE320 Relevance: 9.3, Strings: 7, Instructions: 547COMMON
                                    Download Yara Rule
                                    Strings
                                    • malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=, xrefs: 00007FF60ACDEBB6
                                    • unexpected malloc header in delayed zeroing of large objectreflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: Pos, xrefs: 00007FF60ACDEB4C
                                    • mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential, xrefs: 00007FF60ACDEBD8
                                    • malloc deadlockruntime error: elem size wrong with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo, xrefs: 00007FF60ACDEBC7
                                    • mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 00007FF60ACDEBA5
                                    • !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00007FF60ACDE6B3
                                    • delayed zeroing on data that may contain pointersruntime.reflect_makemap: unsupported map key typesweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnableruntime: unable, xrefs: 00007FF60ACDEB5D
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$delayed zeroing on data that may contain pointersruntime.reflect_makemap: unsupported map key typesweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnableruntime: unable$malloc deadlockruntime error: elem size wrong with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo$malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=$mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential$mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= $unexpected malloc header in delayed zeroing of large objectreflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: Pos
                                    • API String ID: 0-1905236817
                                    • Opcode ID: b67c3bf7b8b4be83d5386c87b99dfd3faf5651390b0cb810ecc7d0c296ede8dc
                                    • Instruction ID: acf921323d6364e41b89e866f69980d0c2864866703010fbda015f908c47c9fd
                                    • Opcode Fuzzy Hash: b67c3bf7b8b4be83d5386c87b99dfd3faf5651390b0cb810ecc7d0c296ede8dc
                                    • Instruction Fuzzy Hash: 1432D063A4C69291EA608B11E0403BABB75FB45BD4F6A41B5EE8D8B7D5CF7CE840C700
                                    Function 00007FF60ACD2540 Relevance: 9.2, Strings: 7, Instructions: 474COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 834 7ff60acd2540-7ff60acd2544 835 7ff60acd2e82-7ff60acd2e87 call 7ff60ad36fe0 834->835 836 7ff60acd254a-7ff60acd2559 call 7ff60acded40 834->836 835->834 840 7ff60acd255e-7ff60acd2640 836->840 841 7ff60acd2642-7ff60acd2651 call 7ff60ad38f40 840->841 842 7ff60acd2655-7ff60acd2683 call 7ff60acd2ee0 840->842 841->842 847 7ff60acd2892-7ff60acd2895 842->847 848 7ff60acd2689-7ff60acd26a5 842->848 849 7ff60acd2aa2-7ff60acd2aa5 847->849 850 7ff60acd289b-7ff60acd28b7 847->850 851 7ff60acd26ec-7ff60acd2717 848->851 852 7ff60acd26a7-7ff60acd26c9 call 7ff60ad1d500 848->852 855 7ff60acd2bf3-7ff60acd2c22 call 7ff60acd2ea0 849->855 856 7ff60acd2aab-7ff60acd2ac7 849->856 857 7ff60acd2901-7ff60acd292c 850->857 858 7ff60acd28b9-7ff60acd28db call 7ff60ad1d500 850->858 853 7ff60acd2731-7ff60acd2764 851->853 854 7ff60acd2719-7ff60acd272d call 7ff60ad38f40 851->854 871 7ff60acd26de-7ff60acd26e8 852->871 872 7ff60acd26cb-7ff60acd26da call 7ff60ad38f40 852->872 864 7ff60acd277c-7ff60acd27b0 853->864 865 7ff60acd2766-7ff60acd2778 call 7ff60ad38f40 853->865 854->853 884 7ff60acd2e7c-7ff60acd2e81 855->884 885 7ff60acd2c28-7ff60acd2ce8 call 7ff60acd2ea0 * 2 855->885 866 7ff60acd2b04-7ff60acd2b2d 856->866 867 7ff60acd2ac9-7ff60acd2ae8 call 7ff60ad1d500 856->867 861 7ff60acd2943-7ff60acd2976 857->861 862 7ff60acd292e-7ff60acd293f call 7ff60ad38f40 857->862 889 7ff60acd28f3-7ff60acd28fd 858->889 890 7ff60acd28dd-7ff60acd28ef call 7ff60ad38f40 858->890 876 7ff60acd2991-7ff60acd29c5 861->876 877 7ff60acd2978-7ff60acd298d call 7ff60ad38f40 861->877 862->861 881 7ff60acd27b2-7ff60acd27c4 call 7ff60ad38f40 864->881 882 7ff60acd27c8-7ff60acd27fc 864->882 865->864 873 7ff60acd2b44-7ff60acd2b75 866->873 874 7ff60acd2b2f-7ff60acd2b40 call 7ff60ad38f40 866->874 908 7ff60acd2aea-7ff60acd2af9 call 7ff60ad38f40 867->908 909 7ff60acd2afd 867->909 871->851 872->871 893 7ff60acd2b91-7ff60acd2bc3 873->893 894 7ff60acd2b77-7ff60acd2b8d call 7ff60ad38f40 873->894 874->873 897 7ff60acd29dd-7ff60acd2a11 876->897 898 7ff60acd29c7-7ff60acd29d9 call 7ff60ad38f40 876->898 877->876 881->882 886 7ff60acd2814-7ff60acd2851 882->886 887 7ff60acd27fe-7ff60acd2810 call 7ff60ad38f40 882->887 937 7ff60acd2cf0-7ff60acd2d12 call 7ff60acd2ec0 885->937 938 7ff60acd2cea-7ff60acd2cee 885->938 906 7ff60acd2853-7ff60acd2870 call 7ff60ad38f40 886->906 907 7ff60acd2874-7ff60acd288a 886->907 887->886 889->857 890->889 914 7ff60acd2bc5-7ff60acd2bd7 call 7ff60ad38f40 893->914 915 7ff60acd2bdb-7ff60acd2bee 893->915 894->893 901 7ff60acd2a13-7ff60acd2a25 call 7ff60ad38f40 897->901 902 7ff60acd2a29-7ff60acd2a66 897->902 898->897 901->902 920 7ff60acd2a84-7ff60acd2a9a 902->920 921 7ff60acd2a68-7ff60acd2a80 call 7ff60ad38f40 902->921 906->907 907->847 908->909 909->866 914->915 915->855 920->849 921->920 944 7ff60acd2d14-7ff60acd2d1b 937->944 945 7ff60acd2d1d-7ff60acd2d1f 937->945 939 7ff60acd2d41-7ff60acd2d57 938->939 942 7ff60acd2d5d-7ff60acd2df9 call 7ff60acd2ea0 939->942 943 7ff60acd2e76-7ff60acd2e7b 939->943 951 7ff60acd2e11-7ff60acd2e39 call 7ff60acd2ea0 942->951 952 7ff60acd2dfb-7ff60acd2e0a 942->952 947 7ff60acd2d20-7ff60acd2d22 944->947 945->947 949 7ff60acd2d24-7ff60acd2d28 947->949 950 7ff60acd2d39 947->950 949->950 953 7ff60acd2d2a-7ff60acd2d2e 949->953 954 7ff60acd2d3b-7ff60acd2d3d 950->954 958 7ff60acd2e41-7ff60acd2e75 call 7ff60acd2ea0 951->958 959 7ff60acd2e3b-7ff60acd2e40 951->959 952->951 953->950 956 7ff60acd2d30-7ff60acd2d37 953->956 954->939 956->954
                                    Strings
                                    • ermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanics, xrefs: 00007FF60ACD25A1
                                    • avx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringEqualSidSetEventIsWindowrecvfrom48828125infinitystrconv.parsing ParseIntThursdaySaturdayFebruaryNovemberDecember%!Month(nil PoolscavengepollDesc, xrefs: 00007FF60ACD2B44
                                    • rdtscppopcntcmd/goheaderAnswerDEBUG: ERROR: FATAL: successempty11error51 error3 error4readdirAppDataconsoleCopySidWSARecvWSASendconnectfloat32float64webviewFreeSidSleepEx\\.\UNCinvaliduintptrSwapperChanDir using , type= Value>19531259765625TuesdayJanuaryOctobe, xrefs: 00007FF60ACD25E0
                                    • pclmulqdqmath/randtlsrsakexClassINETAuthorityproductionGlobalFreeGlobalLockGlobalSizeShowWindow/dev/stdinCreateFileowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dll].resolve(dwmapi.dlluser3, xrefs: 00007FF60ACD25BF
                                    • adxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=: p=cas1cas2ca, xrefs: 00007FF60ACD2566
                                    • sse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondsysmontimersefenceselect, xrefs: 00007FF60ACD27C8
                                    • avx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].reject(ole32.dllpsapi.dllwinmm.dllPurgeCommSetupCommcomplex64interfaceinvalid nfuncargs(bad indirreflect: as type Interfa, xrefs: 00007FF60ACD2B91
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: adxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=: p=cas1cas2ca$avx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].reject(ole32.dllpsapi.dllwinmm.dllPurgeCommSetupCommcomplex64interfaceinvalid nfuncargs(bad indirreflect: as type Interfa$avx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringEqualSidSetEventIsWindowrecvfrom48828125infinitystrconv.parsing ParseIntThursdaySaturdayFebruaryNovemberDecember%!Month(nil PoolscavengepollDesc$ermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanics$pclmulqdqmath/randtlsrsakexClassINETAuthorityproductionGlobalFreeGlobalLockGlobalSizeShowWindow/dev/stdinCreateFileowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dll].resolve(dwmapi.dlluser3$rdtscppopcntcmd/goheaderAnswerDEBUG: ERROR: FATAL: successempty11error51 error3 error4readdirAppDataconsoleCopySidWSARecvWSASendconnectfloat32float64webviewFreeSidSleepEx\\.\UNCinvaliduintptrSwapperChanDir using , type= Value>19531259765625TuesdayJanuaryOctobe$sse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondsysmontimersefenceselect
                                    • API String ID: 0-3770322468
                                    • Opcode ID: f5ae85d933dce3fd5d1ad7541e68460234f9844a8fbe8a0cbe685b7207863dab
                                    • Instruction ID: 01b5d6b38d224f26c483bd618779e71997e49f650c9b360e8181a795e4000a8e
                                    • Opcode Fuzzy Hash: f5ae85d933dce3fd5d1ad7541e68460234f9844a8fbe8a0cbe685b7207863dab
                                    • Instruction Fuzzy Hash: 72426777918B4585E300DB24E8447A837B4FB95BC4F6982B6DA8D8B3A1CF7DE499C300
                                    Function 00007FF60AD046E0 Relevance: 2.6, Strings: 2, Instructions: 65COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: PowerRegisterSuspendResumeNotification$powrprof.dll
                                    • API String ID: 0-3247360486
                                    • Opcode ID: 282d507ea5a0d461be9bcaa133736010ddc7e165a396d654e9e85b196e3163d7
                                    • Instruction ID: b57c5d067862e90af64b807c9b822db3e9478d2bf436e71ad2cd34adb2e88787
                                    • Opcode Fuzzy Hash: 282d507ea5a0d461be9bcaa133736010ddc7e165a396d654e9e85b196e3163d7
                                    • Instruction Fuzzy Hash: 27315A77608B8582D600CB11F44176AB7A5FB89BC0F688275EA8C83B95DF7DE151CB40
                                    Function 00007FF60ACF9FE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON
                                    Download Yara Rule
                                    Strings
                                    • grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me, xrefs: 00007FF60ACFA542
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me
                                    • API String ID: 0-3724787384
                                    • Opcode ID: feeea1401a8c46345cce493e9248a479bd279dddb3c72d5e968fe926be9e233c
                                    • Instruction ID: 7a109991b3227e03658ba4026df94a58213f49c5e0faec2f9ad00a76c13015bc
                                    • Opcode Fuzzy Hash: feeea1401a8c46345cce493e9248a479bd279dddb3c72d5e968fe926be9e233c
                                    • Instruction Fuzzy Hash: DEE1A173A4DB8695EA608B15E4803AAB7B0FB85BD0F659179DE8D83799CF3CD054CB00
                                    Function 00007FF60ACE71A0 Relevance: 1.5, Strings: 1, Instructions: 283COMMON
                                    Download Yara Rule
                                    Strings
                                    • span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor, xrefs: 00007FF60ACE7350
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor
                                    • API String ID: 0-1712010102
                                    • Opcode ID: 4f225db3e1da8e2d67392fa33b27cdc14b908f3feca90c9fe2e009fbedc434fc
                                    • Instruction ID: e4ebca37846d6f99019c6f640c94afd313bf15aba74bfc53071ed6aff886c539
                                    • Opcode Fuzzy Hash: 4f225db3e1da8e2d67392fa33b27cdc14b908f3feca90c9fe2e009fbedc434fc
                                    • Instruction Fuzzy Hash: 80D17F33A0DA4296EA54DB14E4922BEB7B0FB85B90F254575EA8D837D5EF3CE444CB00
                                    Function 00007FF60AD17440 Relevance: .3, Instructions: 306COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 76886f3e7331c25afa6874c89285e7793ec5519e57e245326ba860b37dbbccea
                                    • Instruction ID: fa132914851a6d79dd6836bc079148f835cf7cd714b8905e202ec69adbcdfc2c
                                    • Opcode Fuzzy Hash: 76886f3e7331c25afa6874c89285e7793ec5519e57e245326ba860b37dbbccea
                                    • Instruction Fuzzy Hash: 28D14833A0CA4296EB00DB25E49027AB7A4FB857C4F6452B5EA8DC77A5DF7CE444CB40
                                    Function 00007FF60AD0FFE0 Relevance: .2, Instructions: 238COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f80a7d07a40261beb0c1833991fef2890657d2aab185c36c5e221f931b2a0440
                                    • Instruction ID: 99a088295cc8c12fe6c0f85fc562e402a50755b117ba61774d0168b5139586d8
                                    • Opcode Fuzzy Hash: f80a7d07a40261beb0c1833991fef2890657d2aab185c36c5e221f931b2a0440
                                    • Instruction Fuzzy Hash: 1CA19F73E0C602AAEB11AB14D88037977A1EF85BC4F7491B5C94D873D5DE3DE9C58680
                                    Function 00007FF60ACF91E0 Relevance: .1, Instructions: 89COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e1d85a32b0c350f9d4297e3d7eeb9a0e44cd6e83ac63d69feac9711deabeb5f6
                                    • Instruction ID: 015527aa937e70694f2fddd3583244ae1bc77299dcc1a1dc813582638b181aa7
                                    • Opcode Fuzzy Hash: e1d85a32b0c350f9d4297e3d7eeb9a0e44cd6e83ac63d69feac9711deabeb5f6
                                    • Instruction Fuzzy Hash: 3341C77770878695DB44C719E4812F92771EB84BC0FA28176DE0E937A9DE3CE54AC700
                                    Function 00007FF60AD3A620 Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID: LibraryLoad
                                    • String ID:
                                    • API String ID: 1029625771-0
                                    • Opcode ID: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
                                    • Instruction ID: af29960503a0e295b8e34f20932601aaf05772f755ae6cf2bbe37543b6b17167
                                    • Opcode Fuzzy Hash: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
                                    • Instruction Fuzzy Hash: 87115E37A05E4181EB218B1AE4413287374E748BE4F244265DEED577A4CF29E192C700

                                    Non-executed Functions

                                    Function 00007FF60ACEBE60 Relevance: 18.2, Strings: 14, Instructions: 703COMMON
                                    Download Yara Rule
                                    Strings
                                    • ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=, xrefs: 00007FF60ACEC98B
                                    • , xrefs: 00007FF60ACEC43F
                                    • ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32, xrefs: 00007FF60ACEC76A
                                    • gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun, xrefs: 00007FF60ACECC5A
                                    • gc %: gp *(in n= ) - P MPC= < end > ]:pc= G'"'cgodnstcpudpadxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallproot, xrefs: 00007FF60ACEC5CE
                                    • gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625S, xrefs: 00007FF60ACEBF24
                                    • non-concurrent sweep failed to drain all sweep queuescompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - d, xrefs: 00007FF60ACECC38
                                    • @n, xrefs: 00007FF60ACEC918
                                    • MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 00007FF60ACECA45
                                    • @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST, xrefs: 00007FF60ACEC5EC
                                    • MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException , xrefs: 00007FF60ACECA05
                                    • ., xrefs: 00007FF60ACEC54A
                                    • +;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0, xrefs: 00007FF60ACEC736, 00007FF60ACEC8D6
                                    • failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre, xrefs: 00007FF60ACECC49
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: $ @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST$ MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException $ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=$+;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0$.$@n$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre$gc %: gp *(in n= ) - P MPC= < end > ]:pc= G'"'cgodnstcpudpadxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallproot$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun$gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625S$non-concurrent sweep failed to drain all sweep queuescompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - d
                                    • API String ID: 0-1965916994
                                    • Opcode ID: 20a9f1e947cec068c8899a96030df848e90247376e1ba733de23c8f5f173a29a
                                    • Instruction ID: b06fba4fab5472fdcd6447850c0f9e295e5cbd27e4fde54754990491d3fd342f
                                    • Opcode Fuzzy Hash: 20a9f1e947cec068c8899a96030df848e90247376e1ba733de23c8f5f173a29a
                                    • Instruction Fuzzy Hash: AD821937A1CB8295E620DB14E4813BA73A4FB897C0F6552B6DA8C877A6DF3CE444C750
                                    Function 00007FF60ACFCFC0 Relevance: 16.8, Strings: 13, Instructions: 542COMMON
                                    Download Yara Rule
                                    Strings
                                    • , i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) m=nil base numberuser32netdnsCommonrdtscppopcntcmd/goheaderAnswerDEBUG: ERROR: FATAL: successempty11error51 error3 error4readdirAppDataconsoleCopySidWSARecvWSASendconnectfloat32float64webviewFr, xrefs: 00007FF60ACFD845
                                    • , npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by ProcessPrngNetShareAddNetShar, xrefs: 00007FF60ACFD7BC
                                    • runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon, xrefs: 00007FF60ACFD8A5
                                    • bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00007FF60ACFD39C, 00007FF60ACFDAEC
                                    • , : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+, xrefs: 00007FF60ACFD313, 00007FF60ACFD32F, 00007FF60ACFD751, 00007FF60ACFD76F
                                    • runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00007FF60ACFD2BF, 00007FF60ACFD6F6
                                    • runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockjson: unsupported type: invalid pattern syntax: failed to get window rectInvalid matrix dime, xrefs: 00007FF60ACFD825
                                    • , levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 00007FF60ACFD8C5
                                    • ] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+103, xrefs: 00007FF60ACFD736
                                    • ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625SundayMondayFridayAugustUTC-11UTC-02, xrefs: 00007FF60ACFD2F8
                                    • runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileexceeded, xrefs: 00007FF60ACFD36F
                                    • ][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-, xrefs: 00007FF60ACFD2DA, 00007FF60ACFD71B
                                    • , j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringEqualSidSet, xrefs: 00007FF60ACFD7DA
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: , : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+$, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) m=nil base numberuser32netdnsCommonrdtscppopcntcmd/goheaderAnswerDEBUG: ERROR: FATAL: successempty11error51 error3 error4readdirAppDataconsoleCopySidWSARecvWSASendconnectfloat32float64webviewFr$, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringEqualSidSet$, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by ProcessPrngNetShareAddNetShar$] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+103$] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625SundayMondayFridayAugustUTC-11UTC-02$][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon$runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileexceeded$runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockjson: unsupported type: invalid pattern syntax: failed to get window rectInvalid matrix dime$runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
                                    • API String ID: 0-1536050161
                                    • Opcode ID: 8100086eea9d6eb95332ed4f9c776df0943978283ac36c14b4365f4805ce75fe
                                    • Instruction ID: ffd24f9f0b2fd7a5a7242e6840783d751b3d32352c91fdcbb54c673d38eed397
                                    • Opcode Fuzzy Hash: 8100086eea9d6eb95332ed4f9c776df0943978283ac36c14b4365f4805ce75fe
                                    • Instruction Fuzzy Hash: E032B037B58B8681EA20AB11E4407EA7325FB84BC4F6141B6DE9D87BEADE3CD545C700
                                    Function 00007FF60AD20820 Relevance: 15.4, Strings: 12, Instructions: 364COMMON
                                    Download Yara Rule
                                    Strings
                                    • missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGlobalLock failedG, xrefs: 00007FF60AD20CB9, 00007FF60AD20E39
                                    • locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangelooking for beginning of valuein exponent of numeric literalreflect: Len of non-array typeGODEBUG: unknown cpu feature "MIPS JMP reloc not i, xrefs: 00007FF60AD20D35
                                    • untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGl, xrefs: 00007FF60AD20DEC
                                    • and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreek, xrefs: 00007FF60AD20B8F, 00007FF60AD20D1A
                                    • args stack map entries for invalid runtime symbol tableruntime: no module data for traceRegion: alloc too large[originating from goroutine json: Unmarshal(non-pointer !#$%&()*+-./:;<=>?@[]^_{|}~ unexpected end of JSON inputabi.NewName: name too long: operatio, xrefs: 00007FF60AD20BAF
                                    • untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: DefWindowProcWSetWindowTextWmime/multipartWebView2LoaderRCodeNameErrorinvalid whenceShowWindowAsyncUninstallStringGetProcessTimesDuplicateHandleadvertise errorkey, xrefs: 00007FF60AD20C77
                                    • ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05J, xrefs: 00007FF60AD20BF2, 00007FF60AD20D73
                                    • +;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0, xrefs: 00007FF60AD20C92, 00007FF60AD20E0F
                                    • bad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGlobalLock failedGlobalSize failed, xrefs: 00007FF60AD20C0A, 00007FF60AD20D8A
                                    • runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pskip this directoryfile already existsfile does not existfile already closedbinary.LittleEndianafter array elementmultipartmaxheadersRCodeNotImplementedinvalid read lengthGetNativeSyst, xrefs: 00007FF60AD20B73, 00007FF60AD20CFF
                                    • runtime: frame runtimer: bad ptraceback stuckCreateWindowExWPostQuitMessageIsDialogMessagejstmpllitinterptarinsecurepathx509usepolicieszipinsecurepathSetClipboardDataGetClipboardDataGetSystemMetrics0123456789abcdefTerminateProcessinvalid exchangeno route to ho, xrefs: 00007FF60AD20C54, 00007FF60AD20DC9
                                    • (targetpc= , plugin: runtime: g : frame.sp=created by ProcessPrngNetShareAddNetShareDeli/o timeoutMarshalJSONMarshalTextGetMessageWGetAncestorgocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODdXNlcjMyLg==kernel, xrefs: 00007FF60AD20BD7, 00007FF60AD20D58
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: (targetpc= , plugin: runtime: g : frame.sp=created by ProcessPrngNetShareAddNetShareDeli/o timeoutMarshalJSONMarshalTextGetMessageWGetAncestorgocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODdXNlcjMyLg==kernel$ and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreek$ args stack map entries for invalid runtime symbol tableruntime: no module data for traceRegion: alloc too large[originating from goroutine json: Unmarshal(non-pointer !#$%&()*+-./:;<=>?@[]^_{|}~ unexpected end of JSON inputabi.NewName: name too long: operatio$ locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangelooking for beginning of valuein exponent of numeric literalreflect: Len of non-array typeGODEBUG: unknown cpu feature "MIPS JMP reloc not i$ untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: DefWindowProcWSetWindowTextWmime/multipartWebView2LoaderRCodeNameErrorinvalid whenceShowWindowAsyncUninstallStringGetProcessTimesDuplicateHandleadvertise errorkey$ untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGl$) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05J$+;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0$bad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGlobalLock failedGlobalSize failed$missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdjustWindowRectGODEBUG: value "RCodeFormatErrorProgramFiles(x86)globalLock failedGlobalLock failedG$runtime: frame runtimer: bad ptraceback stuckCreateWindowExWPostQuitMessageIsDialogMessagejstmpllitinterptarinsecurepathx509usepolicieszipinsecurepathSetClipboardDataGetClipboardDataGetSystemMetrics0123456789abcdefTerminateProcessinvalid exchangeno route to ho$runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pskip this directoryfile already existsfile does not existfile already closedbinary.LittleEndianafter array elementmultipartmaxheadersRCodeNotImplementedinvalid read lengthGetNativeSyst
                                    • API String ID: 0-332858449
                                    • Opcode ID: a60bb16122401ca96cf067b18e0a148994f22fa01e098e16df8c29d9ce45a06e
                                    • Instruction ID: 91be1e1d943f872fd68e6d683b816079e80f661b97ca58065186a413ac419155
                                    • Opcode Fuzzy Hash: a60bb16122401ca96cf067b18e0a148994f22fa01e098e16df8c29d9ce45a06e
                                    • Instruction Fuzzy Hash: 7AF14E37A08B8685E660EF15E4807AAB365FB48BC0F644271DA8D877E6DF7CE944C710
                                    Function 00007FF60ACEA2E0 Relevance: 14.1, Strings: 11, Instructions: 368COMMON
                                    Download Yara Rule
                                    Strings
                                    • because dotdotdotruntime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of c, xrefs: 00007FF60ACEA7E6
                                    • runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block, xrefs: 00007FF60ACEA854
                                    • runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultjson: invalid number literal, trying to unmarshal %q into Numberwindow.external={invoke:s=>window.chrome.webview.postMessage(s)}unkn, xrefs: 00007FF60ACEA8FC
                                    • , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed, xrefs: 00007FF60ACEA930
                                    • nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod, xrefs: 00007FF60ACEA90D
                                    • runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru, xrefs: 00007FF60ACEA950
                                    • runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already , xrefs: 00007FF60ACEA763, 00007FF60ACEA7B7, 00007FF60ACEA821
                                    • runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerUnable to load WebView2Loader.dll from disk: %v -- or from memory: %wtoo many concurrent operations on a single file or socket , xrefs: 00007FF60ACEA86A
                                    • runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedglobal runq empty wi, xrefs: 00007FF60ACEA93F
                                    • , not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00007FF60ACEA845
                                    • runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= casfrom_Gscanstatus: gp->status is not in scan state, xrefs: 00007FF60ACEA8EB
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: because dotdotdotruntime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of c$, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$, not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed$nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod$runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already $runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedglobal runq empty wi$runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru$runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultjson: invalid number literal, trying to unmarshal %q into Numberwindow.external={invoke:s=>window.chrome.webview.postMessage(s)}unkn$runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerUnable to load WebView2Loader.dll from disk: %v -- or from memory: %wtoo many concurrent operations on a single file or socket $runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= casfrom_Gscanstatus: gp->status is not in scan state$runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block
                                    • API String ID: 0-3871885416
                                    • Opcode ID: f3fea037fbc59c6dc49e0e0531317db027d22dc8bb575e9ce3f20186e49734a6
                                    • Instruction ID: 132741a7d36fde9a6bdac59187d60eabfc7d5b907e49be6c82a516c030d87d1c
                                    • Opcode Fuzzy Hash: f3fea037fbc59c6dc49e0e0531317db027d22dc8bb575e9ce3f20186e49734a6
                                    • Instruction Fuzzy Hash: 2F028F73A09B8295EA60DB11E4423B977B5FB447C0F6A42B5DA8C937D5EF2CE444C700
                                    Function 00007FF60ACD1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                    • String ID:
                                    • API String ID: 2643109117-0
                                    • Opcode ID: 9f059c4e0d7175df32fdc682b7db7297a43b6be884790895ab4fa97cc0a0551e
                                    • Instruction ID: 770a9607b8e5a9f710d3f41bbd69665da0543e9c5cc5555a52d05c26d50c4a6f
                                    • Opcode Fuzzy Hash: 9f059c4e0d7175df32fdc682b7db7297a43b6be884790895ab4fa97cc0a0551e
                                    • Instruction Fuzzy Hash: 2C517563A19A8391FB409B25E9543B937A0EF897C0F6986B5C94DCB3A2DF3CE441C740
                                    Function 00007FF60ACF6AE0 Relevance: 13.3, Strings: 10, Instructions: 810COMMON
                                    Download Yara Rule
                                    Strings
                                    • nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].re, xrefs: 00007FF60ACF75C8
                                    • sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionattempte, xrefs: 00007FF60ACF74E6
                                    • previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:, xrefs: 00007FF60ACF75E5
                                    • swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00007FF60ACF74F7
                                    • mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdea, xrefs: 00007FF60ACF794A
                                    • sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine for type , xrefs: 00007FF60ACF7538, 00007FF60ACF7905
                                    • mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 00007FF60ACF7578
                                    • mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1, xrefs: 00007FF60ACF795B
                                    • mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00007FF60ACF7553, 00007FF60ACF7925
                                    • sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt, xrefs: 00007FF60ACF762F
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$ nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].re$ previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:$ sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine for type $mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdea$mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1$sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionattempte$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
                                    • API String ID: 0-991432480
                                    • Opcode ID: dd4d95e8eb000408a3d75874c816563ffde6c3c5b0940106734e96a78eccf9cb
                                    • Instruction ID: add1443881c36934da61ee0401ef9587db2741f0fc1e8ae8f658689bed10cdaf
                                    • Opcode Fuzzy Hash: dd4d95e8eb000408a3d75874c816563ffde6c3c5b0940106734e96a78eccf9cb
                                    • Instruction Fuzzy Hash: 84828D33A4CA8292E7609B11E4407BA77B1FB85BC4F6551B6EA8D83B95DF3CE454CB00
                                    Function 00007FF60AD2C7E0 Relevance: 8.0, Strings: 6, Instructions: 450COMMON
                                    Download Yara Rule
                                    Strings
                                    • fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecR, xrefs: 00007FF60AD2CE32
                                    • pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+12, xrefs: 00007FF60AD2CE72
                                    • ...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14 m=StdDltfinobjgc %: gp *(in n, xrefs: 00007FF60AD2CC77
                                    • non-Go function at pc=RtlLookupFunctionEntry into Go struct field json: unknown field %qCompareBrowserVersionssetClipboardData failedGetClipboardData failedInvalid recovery amountdevice or resource busyinterrupted system callno space left on deviceoperation no, xrefs: 00007FF60AD2CF9B
                                    • sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtes, xrefs: 00007FF60AD2CE52
                                    • ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05J, xrefs: 00007FF60AD2CCCD
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtestWexecWexecR$ pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+12$ sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocaldefersweeptestRtes$) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05J$...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14 m=StdDltfinobjgc %: gp *(in n$non-Go function at pc=RtlLookupFunctionEntry into Go struct field json: unknown field %qCompareBrowserVersionssetClipboardData failedGetClipboardData failedInvalid recovery amountdevice or resource busyinterrupted system callno space left on deviceoperation no
                                    • API String ID: 0-1007798798
                                    • Opcode ID: 3fe719c042daaea98e7c643f8eec413020d3404a13d9e5770bbd4579f7a71014
                                    • Instruction ID: 3b48d948d98012aa5e805633d78e6c58efc7290f1c2fc8526fbb9d898f8ccd22
                                    • Opcode Fuzzy Hash: 3fe719c042daaea98e7c643f8eec413020d3404a13d9e5770bbd4579f7a71014
                                    • Instruction Fuzzy Hash: A4222A3761DBC185E6609B11E4947AEB760FB997C0F244275EA8D87BAACF3DD844CB00
                                    Function 00007FF60ACF18E0 Relevance: 7.7, Strings: 6, Instructions: 177COMMON
                                    Download Yara Rule
                                    Strings
                                    • base of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+054, xrefs: 00007FF60ACF1B1B
                                    • objgc %: gp *(in n= ) - P MPC= < end > ]:pc= G'"'cgodnstcpudpadxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallpr, xrefs: 00007FF60ACF1B36
                                    • greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did n, xrefs: 00007FF60ACF1B6F
                                    • +;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0, xrefs: 00007FF60ACF1AE5
                                    • runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflo, xrefs: 00007FF60ACF1AA7
                                    • marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during , xrefs: 00007FF60ACF1B5E
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: +;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0$base of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=nulljson'\''icmpigmpermssse3avx2bmi1bmi2.dllerrorfalse%dx%d<nil>writecloseLstatntohsErrorCall int16int32int64uint8arrayslice and kind=1562578125MarchApril+0530+0430+054$greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did n$marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during $objgc %: gp *(in n= ) - P MPC= < end > ]:pc= G'"'cgodnstcpudpadxaesshaavxfmanetZGxsfailtrue.exefilereadseekopenpipeStatbindboolint8uintchanfunccallkind on Call in 3125Atoi-Inf+InfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourallgallpr$runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflo
                                    • API String ID: 0-1098575979
                                    • Opcode ID: 74028a3ed9a107562cb688fea293698fbcdeb6d73138b232c8e82cdaca70dd53
                                    • Instruction ID: 679be9e63e2362eb9fdc7f5e1670f8378fc28f170e2f487d8565d82cd0766b41
                                    • Opcode Fuzzy Hash: 74028a3ed9a107562cb688fea293698fbcdeb6d73138b232c8e82cdaca70dd53
                                    • Instruction Fuzzy Hash: A771CD73A48B8292EB009B11E4407A97774FB45BC0F5842B6EF8D977A6DF6CE194C700
                                    Function 00007FF60AD10A60 Relevance: 7.2, Strings: 5, Instructions: 943COMMON
                                    Download Yara Rule
                                    Strings
                                    • findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for traceReg, xrefs: 00007FF60AD119AC
                                    • global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsCreateCoreWebView2EnvironmentWithOptionscould not resolve symbol %q in module %qunexpected call to os.Exit(0) during testcan't call pointer , xrefs: 00007FF60AD1198A
                                    • findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlineRISC-V LOW12I reloc not implementedRISC-V LOW12S reloc not implementedItanium Imm64 r, xrefs: 00007FF60AD1199B
                                    • findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionNetUserGetLocalGroupsGetProfilesDirectoryWbad type in compare: after to, xrefs: 00007FF60AD119CE
                                    • findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r, xrefs: 00007FF60AD119BD
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for traceReg$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlineRISC-V LOW12I reloc not implementedRISC-V LOW12S reloc not implementedItanium Imm64 r$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionNetUserGetLocalGroupsGetProfilesDirectoryWbad type in compare: after to$global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsCreateCoreWebView2EnvironmentWithOptionscould not resolve symbol %q in module %qunexpected call to os.Exit(0) during testcan't call pointer
                                    • API String ID: 0-3241008627
                                    • Opcode ID: 96e61d1265dcf79d5a0dabb067b463dc985f3e14bf88ab1a05d50a959bd3061c
                                    • Instruction ID: 07bee8518f1dd398eddc5bab548ddb5efdb92f952c29184d5a0cdec552065fc1
                                    • Opcode Fuzzy Hash: 96e61d1265dcf79d5a0dabb067b463dc985f3e14bf88ab1a05d50a959bd3061c
                                    • Instruction Fuzzy Hash: 5A925B33A0D68695EB609B11E4803FA73A4FB85BC0F6842B9DA8D977D5CE3DE485C740
                                    Function 00007FF60AD09780 Relevance: 6.5, Strings: 5, Instructions: 298COMMON
                                    Download Yara Rule
                                    Strings
                                    • , gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp, xrefs: 00007FF60AD09BF0
                                    • suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function address family not supported by protocolreflect.Value.Call: call of nil functionreflect.Value.Call: wron, xrefs: 00007FF60AD09CAA
                                    • invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdju, xrefs: 00007FF60AD09C99
                                    • runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileexceeded max depthinvalid character in numeric literalPostThre, xrefs: 00007FF60AD09BBA
                                    • , goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoRe, xrefs: 00007FF60AD09BD5, 00007FF60AD09C57
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: , goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoRe$, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp$invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GetCurrentThreadRtlVirtualUnwindafter object keyRegisterClassExWTranslateMessageDispatchMessageWAdju$runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileexceeded max depthinvalid character in numeric literalPostThre$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function address family not supported by protocolreflect.Value.Call: call of nil functionreflect.Value.Call: wron
                                    • API String ID: 0-1295745489
                                    • Opcode ID: 181abbb8e578d298f47d5fb72c3c1fa9e28a159ed069d81c290e640dd917b3f4
                                    • Instruction ID: 399046a3bb38861c0a400ecdfe0efa9c2ceb3154666a283c0ac213fed4c061c6
                                    • Opcode Fuzzy Hash: 181abbb8e578d298f47d5fb72c3c1fa9e28a159ed069d81c290e640dd917b3f4
                                    • Instruction Fuzzy Hash: 44E12077A0C78182E710DB15E051BAEBB65FB85BD0F2452B5EA9D83BE6CE3CD5408B10
                                    Function 00007FF60ACF22A0 Relevance: 6.4, Strings: 5, Instructions: 179COMMON
                                    Download Yara Rule
                                    Strings
                                    • MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from dalTLDpSugct?GetTempPath2W, xrefs: 00007FF60ACF2525
                                    • (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptEx, xrefs: 00007FF60ACF24C5
                                    • +;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0, xrefs: 00007FF60ACF2545
                                    • -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-, xrefs: 00007FF60ACF2505
                                    • pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong P, xrefs: 00007FF60ACF24A6
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type number shlwapiavx512fos/execruntime#internU2VuZA==SW5wdXQ=IsIconicFullPathno anodeCancelIoReadFileAcceptEx$ MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from dalTLDpSugct?GetTempPath2W$+;-=/M<1_Ly, : i))(??2500M [("")) ) @s -> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0$-> Pn=][}]> +{}":LlLtLuMn"###EOF???\\?nil\\.\??intmapptr...125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-$pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong P
                                    • API String ID: 0-3306728289
                                    • Opcode ID: da428b16634114def18819a9a5c5ad9833046f00a90852a687457b6e47873834
                                    • Instruction ID: 0bfee660bab5707564b4b075ed943e0a7b73c89d826943ea90b768855ed77e84
                                    • Opcode Fuzzy Hash: da428b16634114def18819a9a5c5ad9833046f00a90852a687457b6e47873834
                                    • Instruction Fuzzy Hash: 8D81D533D1CB9585E611EB25E4402A9B764FF8ABC0F2583B5EA8D977A6CF3CD0818740
                                    Function 00007FF60ACDC860 Relevance: 6.3, Strings: 5, Instructions: 80COMMON
                                    Download Yara Rule
                                    Strings
                                    • packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseL, xrefs: 00007FF60ACDC925
                                    • cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value39, xrefs: 00007FF60ACDC905
                                    • runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p, xrefs: 00007FF60ACDC8E5
                                    • -> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac, xrefs: 00007FF60ACDC945
                                    • lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcProces, xrefs: 00007FF60ACDC96F
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: -> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac$ cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value39$ packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseL$lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcProces$runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p
                                    • API String ID: 0-1730742742
                                    • Opcode ID: 8f2eb9a2b8997e63b78ae9ff9b4a00650a393834701e09d39371975257449b94
                                    • Instruction ID: 29cb4f80c61b2800fa9284bd6dc13cf794f17ac5e88fcc73c2cf3e246c620d53
                                    • Opcode Fuzzy Hash: 8f2eb9a2b8997e63b78ae9ff9b4a00650a393834701e09d39371975257449b94
                                    • Instruction Fuzzy Hash: 1C314F33A58B4696E600AF10E8416BDB764FF49BC0F6946B0EA9D877A6CF2CD444C714
                                    Function 00007FF60ACEB280 Relevance: 5.3, Strings: 4, Instructions: 334COMMON
                                    Download Yara Rule
                                    Strings
                                    • != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase, xrefs: 00007FF60ACEB7F1
                                    • p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRight, xrefs: 00007FF60ACEB818
                                    • runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64, xrefs: 00007FF60ACEB7BB
                                    • flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan, xrefs: 00007FF60ACEB7D6
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase$ flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan$p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRight$runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64
                                    • API String ID: 0-4177187854
                                    • Opcode ID: db033016f78a97d3413a5c659bc74f07ec80ba9ecf4af80d6aadedeb8fa68c6c
                                    • Instruction ID: 5800c0ccce38672f0b51f2f672dca5d0e57e955e13a77d0e1cc34bf9b2539cd4
                                    • Opcode Fuzzy Hash: db033016f78a97d3413a5c659bc74f07ec80ba9ecf4af80d6aadedeb8fa68c6c
                                    • Instruction Fuzzy Hash: 18F15D33A08B4296E710DB24E48137A77A5FB457D0F6582B5DA9D83BA5DF3CE844C740
                                    Function 00007FF60ACD40E0 Relevance: 5.3, Strings: 4, Instructions: 294COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 2-by$expa$nd 3$te k
                                    • API String ID: 0-3581043453
                                    • Opcode ID: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
                                    • Instruction ID: 65304bddf4bf0ab02c867c1957945afb1e7aa958cadc0a3f277e0500ec76e40e
                                    • Opcode Fuzzy Hash: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
                                    • Instruction Fuzzy Hash: C3B1C066F29FD94AF323A63810036B7EB185FFB9C9A40E327FC9474A87D72095036254
                                    Function 00007FF60AD0D360 Relevance: 5.3, Strings: 4, Instructions: 266COMMON
                                    Download Yara Rule
                                    Strings
                                    • casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangejson: invalid number literal %qin literal true (expecting 'r')in literal t, xrefs: 00007FF60AD0D76F
                                    • casgstatus: waiting for Gwaiting but is Grunnableruntime: unable to acquire - semaphore out of syncmallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCall, xrefs: 00007FF60AD0D6DB
                                    • runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid , xrefs: 00007FF60AD0D727
                                    • newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].reject(ole32.dllpsapi.dllw, xrefs: 00007FF60AD0D745
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes wsaioctlkernel32SetFocusavx512bwavx512vlgo/typesnet/httpgo/buildx509sha1ClassANYQuestiondownloadsDownloadsFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dll].reject(ole32.dllpsapi.dllw$casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangejson: invalid number literal %qin literal true (expecting 'r')in literal t$casgstatus: waiting for Gwaiting but is Grunnableruntime: unable to acquire - semaphore out of syncmallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCall$runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid
                                    • API String ID: 0-2301614297
                                    • Opcode ID: b2e194b5385a0a913317b5ce0643d29fd988f55a6f3ebafca10e78eff0d7cfdb
                                    • Instruction ID: a22ba107228c4e5f645ad93c79168848160fa4f4ff47ba54a351883ca6c90319
                                    • Opcode Fuzzy Hash: b2e194b5385a0a913317b5ce0643d29fd988f55a6f3ebafca10e78eff0d7cfdb
                                    • Instruction Fuzzy Hash: 5CC15D37A09A8586E610DB65E08577E7762FB4ABC0F648272DA9C837E6DF3DE441C700
                                    Function 00007FF60AD09FC0 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                    Download Yara Rule
                                    Strings
                                    • reflect., xrefs: 00007FF60AD0A1AC
                                    • runtime., xrefs: 00007FF60AD0A152
                                    • runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff in string literalSHCreateMemStreamGetWindowLongPtrWSetWindowLongPtrWmultipartmaxpartsmz: b, xrefs: 00007FF60AD0A185
                                    • bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: DefWindo, xrefs: 00007FF60AD0A273
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: DefWindo$reflect.$runtime.$runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff in string literalSHCreateMemStreamGetWindowLongPtrWSetWindowLongPtrWmultipartmaxpartsmz: b
                                    • API String ID: 0-2296074645
                                    • Opcode ID: a0a80ba4ace492d864c51c655d9bf9733eb7bda5b97a3e0cdc3934049c3c409d
                                    • Instruction ID: dd573b86138f138b6a4275e668bfec3fe7b00481dc61bfeceb08a50cb623185c
                                    • Opcode Fuzzy Hash: a0a80ba4ace492d864c51c655d9bf9733eb7bda5b97a3e0cdc3934049c3c409d
                                    • Instruction Fuzzy Hash: A7818F33B08B418AEB648B20D0407BA72A1FB95BD4F6852B5DB4D977E5DF3DE8918700
                                    Function 00007FF60AD06900 Relevance: 4.0, Strings: 3, Instructions: 273COMMON
                                    Download Yara Rule
                                    Strings
                                    • runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=Incompatible matrix dimensions for multiplicationinvalid or incomplete multibyte or wide characterfunction may only return a value or a value+errornot enough signif, xrefs: 00007FF60AD06D67
                                    • self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableLittleEndianUpdateWindowPostMessageWResult: %08xmultipathtcpgotypesa, xrefs: 00007FF60AD06DA5
                                    • runtime.preemptM: duplicatehandle failedglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsCreateCoreWebView2EnvironmentWithOptionscould not resolve symbol %q in module %qunexpected call to o, xrefs: 00007FF60AD06D8F
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=Incompatible matrix dimensions for multiplicationinvalid or incomplete multibyte or wide characterfunction may only return a value or a value+errornot enough signif$runtime.preemptM: duplicatehandle failedglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsCreateCoreWebView2EnvironmentWithOptionscould not resolve symbol %q in module %qunexpected call to o$self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableLittleEndianUpdateWindowPostMessageWResult: %08xmultipathtcpgotypesa
                                    • API String ID: 0-1549910287
                                    • Opcode ID: 66678ef200bcddfacdd84758e365ace3ed2ceda1e906b03957e659c4d905e224
                                    • Instruction ID: 43558cf373137be016b441dbc62d366d4f418e6199684b1292cf0ed611b49542
                                    • Opcode Fuzzy Hash: 66678ef200bcddfacdd84758e365ace3ed2ceda1e906b03957e659c4d905e224
                                    • Instruction Fuzzy Hash: ACD16C77A09B8181D660DB25E8413BA7760FB86BD0F258276DAAC837D5DF7CD491CB00
                                    Function 00007FF60AD0DCC0 Relevance: 4.0, Strings: 3, Instructions: 245COMMON
                                    Download Yara Rule
                                    Strings
                                    • stopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len ou, xrefs: 00007FF60AD0E0A5
                                    • stopTheWorld: not stopped (stopwait != 0)could not resolve ordinal %d in module %qreflect: Call with too few input argumentsmismatch between ABI description and typesMapIter.Value called on exhausted iterator1734723475976807094411924481391906738281258673617379, xrefs: 00007FF60AD0DFE0
                                    • stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin, xrefs: 00007FF60AD0E05B
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: stopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len ou$stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin$stopTheWorld: not stopped (stopwait != 0)could not resolve ordinal %d in module %qreflect: Call with too few input argumentsmismatch between ABI description and typesMapIter.Value called on exhausted iterator1734723475976807094411924481391906738281258673617379
                                    • API String ID: 0-3543418984
                                    • Opcode ID: 5aa6a0540efac6ba023bbdcb22b7394437726b5491f2a3af1439677265927957
                                    • Instruction ID: b599ec1b1b8914103300c6f1dd727ea812619fe4c551ec818d3d970bc1daa7ad
                                    • Opcode Fuzzy Hash: 5aa6a0540efac6ba023bbdcb22b7394437726b5491f2a3af1439677265927957
                                    • Instruction Fuzzy Hash: 92B15C77A0D68286EB50CB61E44077AB7A5FB85BC0F2482B6DA8D837E5CE3DE445C740
                                    Function 00007FF60AD1D500 Relevance: 1.7, Strings: 1, Instructions: 441COMMON
                                    Download Yara Rule
                                    Strings
                                    • !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00007FF60AD1D60D, 00007FF60AD1D716, 00007FF60AD1D857, 00007FF60AD1D97F
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
                                    • API String ID: 0-2911004680
                                    • Opcode ID: 755057ceca1a695493b4e09321eac1264c36c0ba9db76b1b8dee8683e70a0cf7
                                    • Instruction ID: e253a3c3c5c299cbbce1054200aa5eec2172166cb7b66cf81abb2e03897c0e54
                                    • Opcode Fuzzy Hash: 755057ceca1a695493b4e09321eac1264c36c0ba9db76b1b8dee8683e70a0cf7
                                    • Instruction Fuzzy Hash: 1002DF23B4C682A5FA10DB15E4143B9B666FB45BD0FA842B5EA9E837C5DF7CE941C300
                                    Function 00007FF60AD00180 Relevance: 1.5, Strings: 1, Instructions: 266COMMON
                                    Download Yara Rule
                                    Strings
                                    • runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin, xrefs: 00007FF60AD00525
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin
                                    • API String ID: 0-429552053
                                    • Opcode ID: 90042688f49db71500f523f2706235332e748ec483e2f9433c1a3396dca27274
                                    • Instruction ID: 76fd3e955504a6a4bcde669459361cbb3ca0189f220420b7ae9b5013eb628b07
                                    • Opcode Fuzzy Hash: 90042688f49db71500f523f2706235332e748ec483e2f9433c1a3396dca27274
                                    • Instruction Fuzzy Hash: 53B18F77A0CB8592DA10CB11E440A6EB764FB89BC0F645272EE8D97BA9CF3CD551CB40
                                    Function 00007FF60AD4AA40 Relevance: 1.5, Strings: 1, Instructions: 262COMMON
                                    Download Yara Rule
                                    Strings
                                    • ParseFloat%!Weekday(notifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug call flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(, xrefs: 00007FF60AD4AC96, 00007FF60AD4AD6E, 00007FF60AD4AE33
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: ParseFloat%!Weekday(notifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug call flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(
                                    • API String ID: 0-3791648319
                                    • Opcode ID: 8083993a27700a2bcb0baecee963a5fc9cf1b4d562a218d6acfd6acc3dcb11b2
                                    • Instruction ID: c897bc6c4653e301c23aef060707eec91c9d46d7451115a46e54626dbd8ad4e9
                                    • Opcode Fuzzy Hash: 8083993a27700a2bcb0baecee963a5fc9cf1b4d562a218d6acfd6acc3dcb11b2
                                    • Instruction Fuzzy Hash: F3C19273A4CB8186E665DB11F4403AA73A9FB84BC0F6442B6EA8C977A9DF3CD540C700
                                    Function 00007FF60AD4AF00 Relevance: 1.5, Strings: 1, Instructions: 261COMMON
                                    Download Yara Rule
                                    Strings
                                    • ParseFloat%!Weekday(notifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug call flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(, xrefs: 00007FF60AD4B156, 00007FF60AD4B22F, 00007FF60AD4B2F4
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: ParseFloat%!Weekday(notifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug call flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(
                                    • API String ID: 0-3791648319
                                    • Opcode ID: 5d3c28188a2b96cf94158475923876a819e3f4bdff1703c1d93dc667ab139dc0
                                    • Instruction ID: 1e7b699522daabcd5149378d0e8384e254e3bce9a70f7c9e5687e9713ae8e776
                                    • Opcode Fuzzy Hash: 5d3c28188a2b96cf94158475923876a819e3f4bdff1703c1d93dc667ab139dc0
                                    • Instruction Fuzzy Hash: E7C15073A08B8186EB659F11F4403AA77A8FB95BC0F6492B6EA8C87795DF3CD550C700
                                    Function 00007FF60ACE5DA0 Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                    Download Yara Rule
                                    Strings
                                    • bulkBarrierPreWrite: unaligned argumentsrefill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs, xrefs: 00007FF60ACE6147
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: bulkBarrierPreWrite: unaligned argumentsrefill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs
                                    • API String ID: 0-866072839
                                    • Opcode ID: c90b77b8830b9cee64d45adbe7cfc34da4f2bccb826234be702ad72c4483e77c
                                    • Instruction ID: 2b2fc26a8e52b5cb45bc7d9f47cd9ece4ce9959c35e0c7356881d6c512a5e3be
                                    • Opcode Fuzzy Hash: c90b77b8830b9cee64d45adbe7cfc34da4f2bccb826234be702ad72c4483e77c
                                    • Instruction Fuzzy Hash: C6A1F0B7A19B9581EB50CB16E4012AEA7B1FB48FC4F258172EE4C87B59EF3CD4918700
                                    Function 00007FF60ACFF360 Relevance: 1.4, Strings: 1, Instructions: 189COMMON
                                    Download Yara Rule
                                    Strings
                                    • bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00007FF60ACFF627
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod
                                    • API String ID: 0-2099802129
                                    • Opcode ID: 3b66ac3edf4e71863b0635293b068592d0c1830b88c709e48405529fd498b817
                                    • Instruction ID: 6d753dfbc46a9dd13577b0633170e84dfd9d941dc44176c1f61065b101cbc3fa
                                    • Opcode Fuzzy Hash: 3b66ac3edf4e71863b0635293b068592d0c1830b88c709e48405529fd498b817
                                    • Instruction Fuzzy Hash: 1671F0B3B58B8582EA009B15E4403A97375FB89BD0F65427AEE9D937D6CE7CE480C340
                                    Function 00007FF60ACEB940 Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                    Download Yara Rule
                                    Strings
                                    • gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625S, xrefs: 00007FF60ACEBB14
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:ole32filesGreeksse41sse42ssse3ntdllPDFEzyINFO: WARN: empty1empty2error2removelistensocketStringFormat[]bytestringGetAceGetACPsendtouint16uint32uint64structchan<-<-chan Value390625S
                                    • API String ID: 0-1879786653
                                    • Opcode ID: 02ca466dbc951129968e61d168ffd3d8c6c56ada816d4942c79c846238385bcd
                                    • Instruction ID: 9c05ea164d1c38463dccfe4553509144becfd52bf5f0d1bfb6fec62f245c0821
                                    • Opcode Fuzzy Hash: 02ca466dbc951129968e61d168ffd3d8c6c56ada816d4942c79c846238385bcd
                                    • Instruction Fuzzy Hash: 37910833A0CA4295E700DB60E4813BAB7B4FB857D0F6582B6EA9D876A5DF3DE444C740
                                    Function 00007FF60ACF2020 Relevance: 1.3, Strings: 1, Instructions: 97COMMON
                                    Download Yara Rule
                                    Strings
                                    • gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not , xrefs: 00007FF60ACF2110
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not
                                    • API String ID: 0-3110597650
                                    • Opcode ID: 97b29141462e2fbba1c2b9548a6be4a931b4bbf789a2de50c77cf3238ea6bb48
                                    • Instruction ID: 0f56e34fea6ca6b0c7de30c10d57a8ad50f7dee6887ecdc204c77c0d1f40ecab
                                    • Opcode Fuzzy Hash: 97b29141462e2fbba1c2b9548a6be4a931b4bbf789a2de50c77cf3238ea6bb48
                                    • Instruction Fuzzy Hash: A321BCF3B46A8542EB009F14D4403E86722E756FD8F5AA0B5CF4D97786CE6CC596C300
                                    Function 00007FF60AD49BA0 Relevance: .4, Instructions: 373COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dda375d627d732c85cc583b6e5afd8bb722a31e253b6f9687ac3f1dd513587c4
                                    • Instruction ID: 5b1b7a1e46b510a486f59681a96feaf60f9183338ccdc315dd85042c01afa841
                                    • Opcode Fuzzy Hash: dda375d627d732c85cc583b6e5afd8bb722a31e253b6f9687ac3f1dd513587c4
                                    • Instruction Fuzzy Hash: C2D1F413F0C5A146EB218722E4207BB7A92E781BC0F6856B1EE8D57BDACE7DD841D710
                                    Function 00007FF60AD4FF80 Relevance: .4, Instructions: 356COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9e34675fcd3e560ea9b46b719ef349234e3bca018d016c7e7cf7fb67c2717e4f
                                    • Instruction ID: a8ec0d745d789a1b1767bebc142c250e0a87fe4a7f65741046b41fdabc63e06b
                                    • Opcode Fuzzy Hash: 9e34675fcd3e560ea9b46b719ef349234e3bca018d016c7e7cf7fb67c2717e4f
                                    • Instruction Fuzzy Hash: D1D1C523F0C65586EA54CB26E401ABAB751FB89BC4F644171EE8DC7B99CE3CD945C700
                                    Function 00007FF60AD4CB40 Relevance: .3, Instructions: 324COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 168d25f5af48d10d4dea5ed41eaad889904874b6cd2260b7045d0b4de342701f
                                    • Instruction ID: f85cbd6ede1a385ce6456638f0c3cbdbf74193d072d485f236561df95529c458
                                    • Opcode Fuzzy Hash: 168d25f5af48d10d4dea5ed41eaad889904874b6cd2260b7045d0b4de342701f
                                    • Instruction Fuzzy Hash: B8B1E773F2EA8183EA198719D1043B87656EB44FD4FE882B1C64E877C6DF6CA5568300
                                    Function 00007FF60ACEF660 Relevance: .3, Instructions: 275COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4352c5823b274d3a59877725e0cd16fec01644465b7b8233395ba919350a0574
                                    • Instruction ID: 7bdbd0953d6e70e58b74bc367742310aa56caded37a86781aa72aa4f8e8279cf
                                    • Opcode Fuzzy Hash: 4352c5823b274d3a59877725e0cd16fec01644465b7b8233395ba919350a0574
                                    • Instruction Fuzzy Hash: 8CC1E133A0DB8196EA11CB10E04137977B5EB86BD0F2682B9DA9E977D5DF3CE4818740
                                    Function 00007FF60AD11C20 Relevance: .3, Instructions: 260COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9081ae1d4ec1e6d1a84ddfaf8be54bcde7d684168bc65adef824aeb6d9a18624
                                    • Instruction ID: 694cd3a49ad2b168d43cd11aa9697d7d3a97c8ba54ddf60c7928d4f49bd8ab25
                                    • Opcode Fuzzy Hash: 9081ae1d4ec1e6d1a84ddfaf8be54bcde7d684168bc65adef824aeb6d9a18624
                                    • Instruction Fuzzy Hash: 93A1B267A1C68286D764CB56E01097AB7A1FB85BC0F285279FF8D87B85CF3CE4408B40
                                    Function 00007FF60AD36029 Relevance: .3, Instructions: 259COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ec95d420a7baf1a3593b2d8812f7bcc97ff29d1682d2854064f527c9f20c246d
                                    • Instruction ID: 37882441b6bddca212b13c673371e152186461b6cbfed20fa6b70e46cdfdb13e
                                    • Opcode Fuzzy Hash: ec95d420a7baf1a3593b2d8812f7bcc97ff29d1682d2854064f527c9f20c246d
                                    • Instruction Fuzzy Hash: 95B10C16D1CFDB20E6135678D403A762A24AFF36C4B01D73AFAC6F16B3DB566900B522
                                    Function 00007FF60ACFCB00 Relevance: .2, Instructions: 231COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 06e6395af84849eda2594e2d5ca491baba45c7f66850d3dd62b6f6675eb03e4c
                                    • Instruction ID: 1743318a6e76a3cebaaf703fb37ebfdd075a4e93af10272d043e3b8392a17616
                                    • Opcode Fuzzy Hash: 06e6395af84849eda2594e2d5ca491baba45c7f66850d3dd62b6f6675eb03e4c
                                    • Instruction Fuzzy Hash: BFA15C77A1CB8592DB108B15E0802AAB7B1F789BD4F25527AEB9D47B99CF3CD050CB40
                                    Function 00007FF60ACFDF80 Relevance: .2, Instructions: 219COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2e584ae30d33c387ee35dc5bab8e7d8b30804f784b6aec4754275f0628b64a44
                                    • Instruction ID: 05eebdd4ae56e6de7d8238465f8d2b8f9ce5b641c76a0548a1f526fba192d993
                                    • Opcode Fuzzy Hash: 2e584ae30d33c387ee35dc5bab8e7d8b30804f784b6aec4754275f0628b64a44
                                    • Instruction Fuzzy Hash: 7A91A373A18B8582EA108B15E4803AEA771F789BC0F15517AEF9D57B9ACF7CD080C740
                                    Function 00007FF60AD507A0 Relevance: .2, Instructions: 178COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: edcef3eb7fb2fcebdcb2e8c91e6db3dfba97d910a87f88a05bce1dd00b9502f9
                                    • Instruction ID: 669ce77533eed02dc69653cad099dafbc70dbe37796e1d5ceef886e2cf8d7100
                                    • Opcode Fuzzy Hash: edcef3eb7fb2fcebdcb2e8c91e6db3dfba97d910a87f88a05bce1dd00b9502f9
                                    • Instruction Fuzzy Hash: CF514723F0C6528AFA2C9625D011ABC7A51EB94BD0FB953B5C94E87BC5CE6CEC41C780
                                    Function 00007FF60ACDA940 Relevance: .2, Instructions: 161COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d0cfb378e309d896f4d012ba800402fa4999d61eb0965eeb4accbe0d4dba0415
                                    • Instruction ID: 7747d9cd05d9074711b3073044f16178ca93d4a46cb8ef5099d1780271e8cd06
                                    • Opcode Fuzzy Hash: d0cfb378e309d896f4d012ba800402fa4999d61eb0965eeb4accbe0d4dba0415
                                    • Instruction Fuzzy Hash: 8D51E996B45A9551AE048B53C62007AA371EB4AFD076AE273CE1DB7B9CDE3CE402C344
                                    Function 00007FF60AD21CE0 Relevance: .2, Instructions: 155COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5daa4d25c88fd1e47f1059049e6b4c85ad7eaf3c12fa03ec3cdaaad818d319e0
                                    • Instruction ID: 158be14c643b4aab35254172d1eb909a65af979bd989343dbec6346fec394d47
                                    • Opcode Fuzzy Hash: 5daa4d25c88fd1e47f1059049e6b4c85ad7eaf3c12fa03ec3cdaaad818d319e0
                                    • Instruction Fuzzy Hash: A541A533F885468AEA509E24D4413B57285DB507F0F9887B0EF2D862C2DE2CA895D710
                                    Function 00007FF60ACF7F20 Relevance: .1, Instructions: 138COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 37cb6036a478a01f182d007b7d6c101b281179cf73c1e90344223c5dea53dbe3
                                    • Instruction ID: cc172838758fe8b02700e99e4e5a25de4933fb951c0150f2272afb7ac936fc01
                                    • Opcode Fuzzy Hash: 37cb6036a478a01f182d007b7d6c101b281179cf73c1e90344223c5dea53dbe3
                                    • Instruction Fuzzy Hash: 4651C273A4CB4281EA15CB21E44023AA371EB99BD0F3987B5EA5D937D5DF3CE4818700
                                    Function 00007FF60AD4D400 Relevance: .1, Instructions: 134COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 37d11305c1095332c3d4447bff097d6d4ec48b16bb4f541e608688dedc346756
                                    • Instruction ID: 07e0b3cc39d3ec8cf036d35db3c29c1120a24fe0a5ecd2ff20b2ea190aec75e0
                                    • Opcode Fuzzy Hash: 37d11305c1095332c3d4447bff097d6d4ec48b16bb4f541e608688dedc346756
                                    • Instruction Fuzzy Hash: 4F41F4A3F0469543EE548626D5043B8A2938B96FF4F6C8372DD3EA7BD8EE5CD9418200
                                    Function 00007FF60AD4D200 Relevance: .1, Instructions: 134COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 54fc414a448b4832f92cfc7b591f02393a1be6350950ea3aa2e16130756b50fb
                                    • Instruction ID: 7a0a72026dd1cda66f959a4dda3b427fe74c5e820956b0aa847a7fb93d854150
                                    • Opcode Fuzzy Hash: 54fc414a448b4832f92cfc7b591f02393a1be6350950ea3aa2e16130756b50fb
                                    • Instruction Fuzzy Hash: FC4149A3F4569542EF548A21D5043F4A253EB95FE0FAC8371DE2DABBD8EF5CD8428200
                                    Function 00007FF60ACF3B80 Relevance: .1, Instructions: 106COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8b52bf38f629520bff0f831e87b9f05bbdba58ee714d5eae049a43230f729308
                                    • Instruction ID: 6ef3b0ed37734b6b66fa8a8bf56903497abdbae1018d16fc01d58c09ee29a316
                                    • Opcode Fuzzy Hash: 8b52bf38f629520bff0f831e87b9f05bbdba58ee714d5eae049a43230f729308
                                    • Instruction Fuzzy Hash: 7C4136A3E5FE4665DD079B7AC461134822A9F92BE0774C7B1C83FEA2E4DF1DA0428200
                                    Function 00007FF60AD00FC0 Relevance: .1, Instructions: 84COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d559122a1f6f0b69832be9421c7c214fb777efde5fa0d191de61b1ee1601c01b
                                    • Instruction ID: f8285ee1500bea0b622b220f2b6d2c06caedbd07029bfa44adf686d136e458db
                                    • Opcode Fuzzy Hash: d559122a1f6f0b69832be9421c7c214fb777efde5fa0d191de61b1ee1601c01b
                                    • Instruction Fuzzy Hash: D9313AB6B15B8946EB88CB229A247C9639AFB58BC0F15D275DF0C93758EF38E5508340
                                    Function 00007FF60ACDEEE0 Relevance: .1, Instructions: 63COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 252a1641c399c9d9d4be30fcf7ac50507005ea6e62673b8f3913282413dbc790
                                    • Instruction ID: ca82371d15b409059b72e24f8e07660ba0477cc0acd53b2a717e862d70df09e9
                                    • Opcode Fuzzy Hash: 252a1641c399c9d9d4be30fcf7ac50507005ea6e62673b8f3913282413dbc790
                                    • Instruction Fuzzy Hash: 6321FCE3E25F450ADA47963A955131181165F96BD0F38D332EC1FB97A6EF29A0C38100
                                    Function 00007FF60AD38D80 Relevance: .0, Instructions: 11COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 66c10b6bf1f006778b9d1a1fe6126d3224ab63f22426b4c1ea051f947b17418c
                                    • Instruction ID: fc4c5aa3cf557f950046ab2d2e88396599cc7e84bd0583b489dbdc6db817f745
                                    • Opcode Fuzzy Hash: 66c10b6bf1f006778b9d1a1fe6126d3224ab63f22426b4c1ea051f947b17418c
                                    • Instruction Fuzzy Hash: F6C08CF3E0EA836CFB608300F14032839D5CF243C0DA8C1F0E38C812D5DE6CA2806104
                                    Function 00007FF60ADCE910 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualQuery.KERNEL32(?,?,?,?,00007FF60AEF5B90,00007FF60AEF5B90,?,?,00007FF60ACD0000,?,00007FF60ADCE701), ref: 00007FF60ADCE9D3
                                    • VirtualProtect.KERNEL32(?,?,?,?,00007FF60AEF5B90,00007FF60AEF5B90,?,?,00007FF60ACD0000,?,00007FF60ADCE701), ref: 00007FF60ADCEA37
                                    • memcpy.MSVCRT ref: 00007FF60ADCEA50
                                    • GetLastError.KERNEL32(?,?,?,?,00007FF60AEF5B90,00007FF60AEF5B90,?,?,00007FF60ACD0000,?,00007FF60ADCE701), ref: 00007FF60ADCEA93
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                    • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                    • API String ID: 2595394609-2123141913
                                    • Opcode ID: 4e4af254e15960c299eee42ca29b66d303040cefe8d7e8196cd1878898d3087d
                                    • Instruction ID: d9d1ff916c5d413c16b08bdab8696addb7bae47444e662eb25957488c3393ec3
                                    • Opcode Fuzzy Hash: 4e4af254e15960c299eee42ca29b66d303040cefe8d7e8196cd1878898d3087d
                                    • Instruction Fuzzy Hash: FA4181B3A1964395EA509B05E4446B937A0FB44FC0FA54AB6CE0EC37E1DE3CE646C700
                                    Function 00007FF60ADCE5F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60ACD1247), ref: 00007FF60ADCE769
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000004.00000002.201077387571.00007FF60ACD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60ACD0000, based on PE: true
                                    • Associated: 00000004.00000002.201077365790.00007FF60ACD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077611307.00007FF60ADD5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077833652.00007FF60AEF7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077858286.00007FF60AEF9000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077909765.00007FF60AF22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077939483.00007FF60AF31000.00000008.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF4A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AF51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201077962180.00007FF60AFB8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078085089.00007FF60AFBE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFC8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000004.00000002.201078118067.00007FF60AFD7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_4_2_7ff60acd0000_pdf-ez.jbxd
                                    Similarity
                                    • API ID: ProtectVirtual
                                    • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                    • API String ID: 544645111-395989641
                                    • Opcode ID: be20b077370f06ab36820fd6772346baa81e137e35628540e6c6d36000c71578
                                    • Instruction ID: e5a6527b1a992b7be4b5becb4af28c3d5caa6e8456939f95a9588f9c261108c9
                                    • Opcode Fuzzy Hash: be20b077370f06ab36820fd6772346baa81e137e35628540e6c6d36000c71578
                                    • Instruction Fuzzy Hash: D45199B3A58552C6EB109B21E8407B937A1FB14BD4FA44AB5DA2D877D4CF3CE582CB00